CVE-2024-6278

Executive Summary

CVE-2024-6278 is a critical SQL injection vulnerability discovered in the lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the subject.php file, specifically within the Subject Page component, where the update argument is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete database compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application. However, users should verify the integrity of their downloaded source code and check for any unofficial patches or forks.

CVSS Breakdown & Threat Level

While the official CVSS vector is not provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are within the same security authority.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Estimated CVSS v3.1 Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority threat for any organization using this software.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the subject.php file. The application likely constructs a SQL query by directly concatenating user-supplied input from the update parameter without proper sanitization or parameterized queries.

Vulnerable Code Flow (Hypothetical):

1. The subject.php script receives a POST or GET request with an update parameter.
2. The script constructs a SQL query like: UPDATE subjects SET name = '$_POST['update']' WHERE id = $_POST['id'];
3. An attacker can inject SQL commands by providing a malicious value for the update parameter, such as: ' OR '1'='1' -- -
4. This modifies the query to: UPDATE subjects SET name = '' OR '1'='1' -- -' WHERE id = ...; which updates all rows in the table.

Impact:

• Data Exfiltration: Use UNION SELECT to retrieve data from other tables (e.g., users, passwords).
• Authentication Bypass: Inject into login queries to bypass authentication.
• Data Manipulation: Modify or delete critical records.
• Remote Code Execution (RCE): In some configurations, SQL injection can lead to RCE via xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL).

Vulnerable vs. Patched Code

Since no official patch exists, the comparison is between the vulnerable code and a secure implementation.

Vulnerable Code (PHP):

<?php
$update = $_POST['update'];
$id = $_POST['id'];
$sql = "UPDATE subjects SET name = '$update' WHERE id = $id";
$result = mysqli_query($conn, $sql);
?>

Patched Code (Secure Implementation):

<?php
$update = $_POST['update'];
$id = $_POST['id'];
$stmt = $conn->prepare("UPDATE subjects SET name = ? WHERE id = ?");
$stmt->bind_param("si", $update, $id);
$stmt->execute();
?>

The secure version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Download and install the School Management System v1.0.0 or v1.0.1 on a local web server (e.g., XAMPP, LAMP).
2. Ensure the database is populated with sample data.
3. Access the application and navigate to the Subject Page (e.g., http://localhost/sms/subject.php).

Exploitation Steps:

1. Manual Injection:

   • Intercept the request to subject.php using a proxy like Burp Suite.
   • Modify the update parameter to: ' OR '1'='1' -- -
   • Observe that all subject names are updated.

2. Automated Exploitation with sqlmap:

   sqlmap -u "http://localhost/sms/subject.php" --data="update=test&id=1" --batch --dbs
   

   • This will enumerate databases.

3. Data Exfiltration:

   sqlmap -u "http://localhost/sms/subject.php" --data="update=test&id=1" --batch -D school_db -T users --dump
   

Blue Team (Defensive)

Detection Steps:

1. Web Application Firewall (WAF) Rules: Block requests containing SQL keywords (e.g., OR, UNION, SELECT) in the update parameter.
2. Input Validation: Ensure all user inputs are validated against a whitelist of allowed characters.
3. Database Monitoring: Monitor for unusual SQL queries, especially those with OR 1=1 or UNION SELECT patterns.
4. Log Analysis: Review web server logs for requests to subject.php with suspicious parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to subject.php with parameters containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs.
• File IOCs:
  • Modified subject.php file (if attacker uploads a web shell).
  • New files in the web root (e.g., shell.php, cmd.php).
• Database IOCs:
  • Unauthorized changes to the subjects table.
  • New user accounts in the users table.
  • Queries with UNION SELECT or OR '1'='1' in the database logs.

Detection Engineering

YARA Rule

rule CVE_2024_6278_SQLi_Subject_Page {
    meta:
        description = "Detects SQL injection attempts targeting subject.php in School Management System"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-6278"
    strings:
        $sqli1 = "subject.php" nocase
        $sqli2 = "update=" nocase
        $sqli3 = "OR" nocase
        $sqli4 = "UNION" nocase
        $sqli5 = "SELECT" nocase
        $sqli6 = "1=1" nocase
    condition:
        $sqli1 and $sqli2 and 2 of ($sqli3, $sqli4, $sqli5, $sqli6)
}

Sigma Rule

title: SQL Injection Attempt on subject.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the subject.php file in School Management System
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'subject.php'
        cs-uri-query|contains: 'update='
    keywords:
        - 'OR'
        - 'UNION'
        - 'SELECT'
        - '1=1'
        - '--'
    condition: selection and 1 of keywords
falsepositives:
    - Legitimate use of the word 'OR' in subject names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6278 SQL Injection Attempt on subject.php"; flow:to_server,established; content:"POST"; http_method; content:"subject.php"; http_uri; content:"update="; http_client_body; pcre:"/(OR|UNION|SELECT|1=1|--)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the System: If possible, take the vulnerable system offline or restrict network access to trusted IPs only.
2. Apply Virtual Patching: Use a WAF to block SQL injection patterns targeting subject.php.
3. Manual Code Fix: Replace all dynamic SQL queries in subject.php with prepared statements or parameterized queries.

Long-Term Actions:

1. Vendor Contact: Attempt to contact the vendor (lahirudanushka) for an official patch.
2. Code Audit: Perform a full security audit of the entire application for similar vulnerabilities.
3. Upgrade: If a patched version becomes available, upgrade immediately.
4. Monitoring: Implement continuous monitoring for SQL injection attempts and database anomalies.

Valters IT