CVE-2024-6275

Executive Summary

CVE-2024-6275 is a critical unauthenticated SQL injection vulnerability in the parent.php file of the lahirudanushka School Management System versions 1.0.0 and 1.0.1. The vulnerability allows remote attackers to inject arbitrary SQL commands via the update parameter, leading to full database compromise, data exfiltration, and potential lateral movement. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. No official patch exists, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP web application. However, organizations using this software should treat it as a high-risk supply chain component due to the lack of vendor support and public exploit availability.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and provides full database access.

Deep Dive & Mechanics

The vulnerability resides in parent.php, which handles parent-related operations. The update parameter is directly concatenated into an SQL query without sanitization or parameterization. An attacker can manipulate this parameter to break out of the intended SQL syntax and execute arbitrary commands.

Vulnerable Code Snippet (Conceptual):

$id = $_GET['update'];
$query = "SELECT * FROM parents WHERE id = $id";
$result = mysqli_query($conn, $query);

Exploitation Mechanics:

1. The attacker sends a GET request to parent.php?update=<payload>.
2. The payload contains SQL injection syntax, e.g., 1 UNION SELECT username, password FROM users.
3. The database executes the malicious query, returning sensitive data.
4. The attacker can also use stacked queries or time-based blind injection for data exfiltration.

Impact:

• Full read/write access to the database.
• Extraction of user credentials, personal data, and academic records.
• Potential for remote code execution if the database user has file write privileges (e.g., INTO OUTFILE).

Vulnerable vs. Patched Code

Vulnerable Code (parent.php):

<?php
$id = $_GET['update'];
$query = "SELECT * FROM parents WHERE id = $id";
$result = mysqli_query($conn, $query);
// ... rest of code
?>

Patched Code (Recommended):

<?php
$id = intval($_GET['update']);
$stmt = $conn->prepare("SELECT * FROM parents WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
// ... rest of code
?>

Key Differences:

• Input is cast to integer (intval()) to prevent non-numeric injection.
• Prepared statements with parameterized queries eliminate SQL injection entirely.
• Error handling should be added to prevent information leakage.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running School Management System 1.0.0 or 1.0.1.
• Network access to the web application.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/parent.php?update=1.
2. Test for SQL injection by appending a single quote: http://target/parent.php?update=1' (expects error or behavior change).
3. Use UNION-based injection to extract data:

   http://target/parent.php?update=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

4. Enumerate database tables and columns:

   http://target/parent.php?update=1 UNION SELECT table_name,2,3,4,5,6,7,8,9,10 FROM information_schema.tables--
   

5. Extract user credentials:

   http://target/parent.php?update=1 UNION SELECT username,password,3,4,5,6,7,8,9,10 FROM users--
   

Example Payload (URL-encoded):

GET /parent.php?update=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10-- HTTP/1.1
Host: target

Blue Team (Defensive)

Detection:

• Monitor for abnormal SQL errors in application logs.
• Look for requests to parent.php with suspicious update parameters containing SQL keywords (UNION, SELECT, --, ').
• Use WAF rules to block SQL injection patterns.

Honeypot:

• Deploy a decoy parent.php that logs all requests and alerts on SQL-like patterns.

Lab Setup:

1. Download vulnerable version from vendor (if available) or use a Docker image.
2. Set up a local MySQL database with sample data.
3. Deploy the application on Apache/Nginx with PHP.
4. Test exploitation and detection rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /parent.php with update parameter containing SQL keywords.
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound database connections from the web server to unexpected IPs (data exfiltration).

File IOCs:

• Modified parent.php file (if attacker uploads a webshell).
• Suspicious files in the web root (e.g., cmd.php, shell.php).

Log IOCs:

• Web server logs showing repeated requests to parent.php with varying update values.
• Database logs showing queries with UNION, INTO OUTFILE, or LOAD_FILE.

Detection Engineering

YARA Rule

rule CVE_2024_6275_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-6275 in parent.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6275"
    strings:
        $s1 = "parent.php" nocase
        $s2 = "update=" nocase
        $sqli1 = /update=.*['\"]/ nocase
        $sqli2 = /update=.*UNION/i
        $sqli3 = /update=.*SELECT/i
        $sqli4 = /update=.*--/i
    condition:
        $s1 and $s2 and any of ($sqli*)
}

Sigma Rule

title: SQL Injection Attempt Against CVE-2024-6275
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting parent.php update parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "parent.php?update="
    keywords:
        - "'"
        - "\""
        - "UNION"
        - "SELECT"
        - "--"
        - "/*"
        - "OR 1=1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in update parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6275 SQL Injection Attempt"; flow:to_server,established; content:"parent.php"; http_uri; content:"update="; http_uri; pcre:"/update=.*['\"]|update=.*UNION|update=.*SELECT|update=.*--/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the network if possible.
2. Apply virtual patching using a WAF (e.g., ModSecurity rule to block SQLi patterns in parent.php).
3. Restrict access to parent.php via .htaccess or firewall rules (allow only trusted IPs).

Long-Term Fix:

• Replace the vulnerable code with parameterized queries (see patched code above).
• Conduct a full code audit for similar vulnerabilities.
• Migrate to a supported school management system if vendor remains unresponsive.

Compromise Assessment:

• Check database logs for unauthorized queries.
• Review web server logs for exploitation attempts.
• Scan for webshells or backdoors in the web root.

Valters IT Signature

This report is generated for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.