CVE-2024-0730: Online Time Table Generator SQLi Flaw

CVE-2024-0730 Overview

A critical SQL injection vulnerability was discovered in Project Worlds Online Time Table Generator version 1.0. This vulnerability exists in the course_ajax.php file, where the id parameter is not properly sanitized before being used in database queries. The flaw allows remote attackers to manipulate SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents.

Critical Impact

This SQL injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database, potentially compromising all stored data including user credentials and sensitive academic information.

Affected Products

• Project Worlds Online Time Table Generator 1.0
• projectworlds:online_time_table_generator component

Discovery Timeline

• 2024-01-19 - CVE-2024-0730 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0730

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the course_ajax.php file within the Online Time Table Generator application. The vulnerability stems from insufficient input validation on the id parameter, which is directly incorporated into SQL queries without proper sanitization or parameterization.

The exploit has been publicly disclosed and documented, making this vulnerability particularly dangerous for any exposed installations. Attackers can leverage this flaw to extract sensitive data from the database, bypass authentication mechanisms, modify or delete records, and potentially escalate their access depending on database configuration and privileges.

The network-based attack vector means no local access is required, and the attack can be executed without authentication or user interaction. The impact affects confidentiality, integrity, and availability of the application and its underlying data.

Root Cause

The root cause of this vulnerability is the direct concatenation of user-supplied input into SQL query strings without proper sanitization, parameterization, or use of prepared statements. The id parameter received through the course_ajax.php endpoint is passed directly to database queries, allowing attackers to inject malicious SQL code that alters the intended query logic.

Attack Vector

The attack is initiated remotely over the network by sending crafted HTTP requests to the course_ajax.php endpoint with a malicious payload in the id parameter. Since no authentication is required to access this endpoint, any remote attacker can exploit this vulnerability by manipulating the parameter value to include SQL injection payloads.

A typical attack scenario involves an attacker sending specially crafted requests containing SQL syntax that breaks out of the expected query structure, allowing them to execute arbitrary SQL commands. This could include UNION-based attacks to extract data from other tables, time-based blind SQL injection to enumerate database contents, or stacked queries to modify data.

For detailed technical analysis of the injection point and exploitation methodology, refer to the SQL Injection Analysis documentation.

Detection Methods for CVE-2024-0730

Indicators of Compromise

• Unusual or malformed requests to course_ajax.php containing SQL keywords such as UNION, SELECT, DROP, INSERT, or DELETE
• Database error messages appearing in web server logs or application responses indicating SQL syntax errors
• Unexpected database queries or data access patterns in database audit logs
• Signs of data exfiltration or unauthorized database modifications

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the id parameter
• Implement application-level logging to capture all requests to course_ajax.php with parameter values
• Configure database query logging to identify anomalous or malicious SQL statements
• Use intrusion detection systems (IDS) with SQL injection signature rules

Monitoring Recommendations

• Monitor web server access logs for requests to course_ajax.php with suspicious parameter patterns
• Set up alerts for database errors that may indicate SQL injection attempts
• Track unusual database activity such as bulk data reads or schema enumeration queries
• Review application error logs for SQL-related exceptions or warnings

How to Mitigate CVE-2024-0730

Immediate Actions Required

• Remove or disable the Online Time Table Generator application if not actively required
• Implement input validation and sanitization for all user-supplied parameters
• Deploy a Web Application Firewall (WAF) to filter malicious requests targeting SQL injection
• Restrict network access to the application to trusted IP ranges if possible

Patch Information

At the time of publication, no official patch has been released by the vendor for this vulnerability. Organizations using Project Worlds Online Time Table Generator 1.0 should implement the mitigations and workarounds described below until a security update becomes available. Monitor the VulDB entry for updates on remediation options.

Workarounds

• Modify course_ajax.php to use prepared statements or parameterized queries for all database interactions
• Implement strict input validation to allow only numeric values in the id parameter
• Apply the principle of least privilege to database accounts used by the application
• Consider replacing the vulnerable application with an actively maintained alternative

# Example: Block suspicious requests to course_ajax.php at the web server level (Apache)
# Add to .htaccess or Apache configuration
<LocationMatch "/course_ajax\.php">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (union|select|insert|update|delete|drop|--|') [NC]
    RewriteRule .* - [F,L]
</LocationMatch>