CVE-2024-5116: Online Examination System SQLi Vulnerability

CVE-2024-5116 Overview

CVE-2024-5116 is a SQL Injection vulnerability discovered in SourceCodester Online Examination System version 1.0. The vulnerability exists in the save.php file, where improper sanitization of the vote argument allows attackers to inject malicious SQL queries. This flaw can be exploited remotely without authentication, potentially enabling unauthorized access to sensitive database information, data manipulation, or complete database compromise.

Critical Impact

Remote attackers can exploit this SQL Injection vulnerability to extract sensitive data from the database, modify or delete records, and potentially gain unauthorized access to the underlying system through database-level attacks.

Affected Products

• SourceCodester Online Examination System 1.0
• Warrendaloyan Online Examination System 1.0

Discovery Timeline

• 2024-05-20 - CVE-2024-5116 published to NVD
• 2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-5116

Vulnerability Analysis

This SQL Injection vulnerability stems from insufficient input validation in the save.php file of the Online Examination System. The application fails to properly sanitize user-supplied input passed through the vote parameter before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL commands that are executed by the database server with the same privileges as the application.

The vulnerability is accessible over the network and requires no authentication or user interaction, making it particularly dangerous for publicly accessible installations. Successful exploitation could allow attackers to read, modify, or delete data within the database, bypass authentication mechanisms, or potentially execute administrative operations depending on the database configuration.

Root Cause

The root cause of this vulnerability is the lack of proper input sanitization and parameterized queries in the save.php file. The vote parameter is directly concatenated into SQL statements without validation or escaping, creating a classic SQL Injection attack vector. This represents a failure to implement secure coding practices such as prepared statements or stored procedures that would prevent malicious input from being interpreted as SQL commands.

Attack Vector

The attack vector is network-based, allowing remote exploitation without requiring authentication. An attacker can craft malicious HTTP requests containing SQL injection payloads in the vote parameter. When the vulnerable save.php script processes these requests, the injected SQL code is executed against the backend database.

The vulnerability can be exploited through various SQL injection techniques including:

• Union-based injection: Extracting data from other database tables by appending UNION SELECT statements
• Boolean-based blind injection: Inferring database contents through true/false conditions in responses
• Time-based blind injection: Extracting data by observing response delays from injected time-delay functions
• Error-based injection: Leveraging database error messages to extract information

For detailed technical information about this vulnerability, see the GitHub CVE Issue Discussion and VulDB entry #265196.

Detection Methods for CVE-2024-5116

Indicators of Compromise

• Unusual SQL error messages appearing in application logs or error responses
• Abnormal database queries containing SQL keywords like UNION, SELECT, DROP, INSERT, or -- in the vote parameter
• Unexpected database activity or query patterns originating from web application requests to save.php
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests
• Enable detailed logging for all database queries and monitor for suspicious SQL syntax or injection patterns
• Deploy intrusion detection systems (IDS) configured with SQL injection signature rules
• Review web server access logs for requests to save.php containing encoded or suspicious characters

Monitoring Recommendations

• Configure real-time alerting for database errors that may indicate SQL injection attempts
• Monitor application logs for requests containing SQL metacharacters such as single quotes, semicolons, or comment delimiters
• Implement database activity monitoring to detect unauthorized read or write operations
• Track failed authentication attempts that may indicate injection-based authentication bypass attempts

How to Mitigate CVE-2024-5116

Immediate Actions Required

• Remove or restrict access to the vulnerable Online Examination System until a patch is available
• Implement input validation and parameterized queries in the save.php file
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules as a temporary mitigation
• Review and audit all database interactions in the application for similar vulnerabilities

Patch Information

No official vendor patch has been publicly announced for this vulnerability. Administrators should contact SourceCodester for remediation guidance or implement manual code fixes to sanitize the vote parameter using parameterized queries. Given the nature of this open-source project, organizations should consider implementing their own security patches or replacing the affected component entirely.

Workarounds

• Implement server-side input validation to whitelist acceptable characters and reject SQL metacharacters in the vote parameter
• Replace direct SQL query construction with prepared statements or parameterized queries
• Apply the principle of least privilege to database accounts used by the application to limit potential damage
• Consider taking the affected system offline or restricting network access until proper remediation is implemented

# Example WAF rule for ModSecurity to block common SQL injection patterns
SecRule ARGS:vote "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in vote parameter',\
    log,\
    auditlog"