CVE-2024-0464: Online Faculty Clearance SQLi Vulnerability

CVE-2024-0464 Overview

A critical SQL injection vulnerability has been identified in code-projects Online Faculty Clearance version 1.0. This vulnerability exists in the delete_faculty.php file within the HTTP GET Request Handler component. The flaw allows remote attackers to manipulate the id parameter to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

This SQL injection vulnerability enables unauthenticated remote attackers to compromise the entire database, potentially exposing sensitive faculty records, credentials, and administrative data.

Affected Products

• code-projects Online Faculty Clearance 1.0

Discovery Timeline

• 2024-01-12 - CVE-2024-0464 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0464

Vulnerability Analysis

This vulnerability is a classic SQL injection flaw (CWE-89) that occurs when user-supplied input is directly concatenated into SQL queries without proper sanitization or parameterization. The affected component, delete_faculty.php, accepts an id parameter via HTTP GET requests and uses this value directly in database operations.

The vulnerability allows attackers to inject malicious SQL statements that will be executed by the database server. This can result in complete database compromise, including the ability to read, modify, or delete all data, bypass authentication mechanisms, and potentially escalate to command execution on the underlying server depending on database configuration.

The application fails to implement prepared statements or input validation on the id parameter, making it trivial for attackers to craft malicious payloads. Since the attack vector is network-based and requires no authentication or user interaction, it represents a significant risk to any deployment of this software.

Root Cause

The root cause of this vulnerability is improper input validation and the use of dynamic SQL query construction. The delete_faculty.php script directly incorporates the user-supplied id parameter into SQL queries without using parameterized queries or stored procedures. This allows attackers to break out of the intended query context and inject arbitrary SQL commands.

Attack Vector

The attack is conducted remotely over the network by sending crafted HTTP GET requests to the vulnerable delete_faculty.php endpoint. An attacker manipulates the id parameter to include SQL injection payloads that alter the intended query behavior.

For example, an attacker could append SQL statements to the id parameter to extract sensitive data using UNION-based injection, bypass conditional logic using boolean-based blind injection, or cause time-based delays to enumerate database contents. The exploit has been publicly disclosed and documented, increasing the risk of active exploitation.

Technical details are available in the GitHub SQL Vulnerability Document and the VulDB #250569 Report.

Detection Methods for CVE-2024-0464

Indicators of Compromise

• HTTP GET requests to delete_faculty.php containing SQL metacharacters such as single quotes, semicolons, or SQL keywords in the id parameter
• Database error messages in web server logs indicating malformed SQL queries
• Unusual database query patterns or execution times that may indicate blind SQL injection attempts
• Evidence of unauthorized data access or modification in database audit logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the id parameter
• Configure intrusion detection systems (IDS) to alert on HTTP requests containing common SQL injection payloads
• Enable database query logging and monitor for suspicious or anomalous query patterns
• Deploy application-level logging to capture all requests to delete_faculty.php with full parameter values

Monitoring Recommendations

• Review web server access logs for requests to delete_faculty.php with unusual id parameter values
• Monitor database performance metrics for unexpected spikes that may indicate exploitation attempts
• Establish baseline behavior patterns and alert on deviations in request frequency to sensitive endpoints
• Implement real-time alerting for any database errors related to SQL syntax issues

How to Mitigate CVE-2024-0464

Immediate Actions Required

• Remove or disable access to the delete_faculty.php endpoint until a proper fix can be implemented
• Implement input validation to ensure the id parameter contains only numeric values
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules
• Review database permissions and apply the principle of least privilege to the application's database account

Patch Information

No official vendor patch has been released for this vulnerability. Organizations using code-projects Online Faculty Clearance 1.0 should implement the workarounds described below and consider alternative solutions. Monitor the VulDB #250569 Details page for updates on remediation options.

Workarounds

• Modify the source code to use prepared statements with parameterized queries instead of string concatenation
• Implement strict input validation to reject non-numeric values in the id parameter
• Restrict network access to the application to trusted IP addresses only
• Consider deploying the application behind a reverse proxy with SQL injection filtering capabilities

The following pseudocode demonstrates the recommended approach for fixing the vulnerability:

# Secure implementation using prepared statements
# Replace direct query construction with parameterized queries

# Instead of: $query = "DELETE FROM faculty WHERE id = " . $_GET['id'];
# Use prepared statements:

$stmt = $pdo->prepare("DELETE FROM faculty WHERE id = :id");
$stmt->bindParam(':id', $_GET['id'], PDO::PARAM_INT);
$stmt->execute();

# Additionally, validate input before use:
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
    die("Invalid faculty ID");
}