CVE-2024-6274: School Management System SQLi Vulnerability

CVE-2024-6274 Overview

CVE-2024-6274 is a SQL injection vulnerability in Lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the /attendancelist.php file within the Attendance Report Page component. Attackers can manipulate the aid parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely, though it requires authenticated access with high privileges. Public disclosure of the exploit details increases the risk of opportunistic attacks against affected deployments. The issue is tracked as VDB-269487 and classified under CWE-89.

Critical Impact
Successful exploitation permits unauthorized read and write access to the underlying database, exposing student, staff, and administrative records stored by the School Management System.

Affected Products

Lahirudanushka School Management System 1.0.0
Lahirudanushka School Management System 1.0.1
Component: attendancelist.php (Attendance Report Page)

Discovery Timeline

2024-06-24 - CVE-2024-6274 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6274

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] affecting the Attendance Report Page of the School Management System. The aid request parameter processed by /attendancelist.php is concatenated into a SQL query without proper sanitization or parameterization. An authenticated attacker with sufficient privileges can supply crafted input to alter the query logic. Consequences include disclosure of stored records, modification of database contents, and potential enumeration of authentication data. The attack is delivered over the network and does not require user interaction.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The application takes the aid parameter directly from the HTTP request and embeds it into a dynamic SQL statement. No prepared statements, parameterized queries, or input validation routines are applied before the query executes against the database engine.

Attack Vector

An authenticated attacker sends an HTTP request to /attendancelist.php with a manipulated aid parameter containing SQL syntax. Because the parameter is interpolated into the query string, injected clauses execute with the privileges of the database user configured for the application. Attackers can use UNION-based, boolean-based, or time-based techniques to extract data. Public disclosure of the exploit lowers the barrier for adversaries to weaponize the flaw.

No verified public proof-of-concept code is referenced by the NVD entry. See the Notion SQL Injection Overview and the VulDB CVE-269487 Entry for additional technical detail.

Detection Methods for CVE-2024-6274

Indicators of Compromise

HTTP requests to /attendancelist.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP in the aid parameter.
Web server access logs showing abnormally long aid values or repeated requests with incremental payload variations consistent with automated SQLi tooling.
Database error messages returned to authenticated users referencing syntax errors near the aid value.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the aid query parameter for SQL injection signatures and block on match.
Enable database query logging and alert on SELECT statements referencing sensitive tables issued from the School Management System application account outside of normal patterns.
Correlate authentication events with subsequent access to /attendancelist.php to identify accounts abused for injection attempts.

Monitoring Recommendations

Monitor for spikes in HTTP 500 responses or database errors originating from attendancelist.php.
Track outbound egress from the database host, which can indicate exfiltration following successful injection.
Review privileged account activity for unusual attendance report requests, especially outside working hours.

How to Mitigate CVE-2024-6274

Immediate Actions Required

Restrict network access to the School Management System to trusted networks or VPN clients while remediation is pending.
Rotate credentials for all administrative accounts capable of triggering the vulnerable endpoint.
Apply a WAF rule to block SQL metacharacters in the aid parameter of /attendancelist.php.
Audit the database user configured for the application and remove privileges that are not required for normal operation.

Patch Information

No vendor patch is referenced in the NVD entry or associated VulDB #269487 record at the time of publication. Operators should monitor the upstream project for updates and consider retiring or replacing the software if a fix is not released. Custom source-level remediation should replace string concatenation in attendancelist.php with parameterized queries and enforce server-side validation of the aid value as a positive integer.

Workarounds

Modify attendancelist.php locally to cast the aid parameter to an integer before use in the SQL query.
Deploy database-level query allow-lists or stored procedures that restrict which statements the application account can execute.
Place the application behind an authenticated reverse proxy to limit exposure to trusted administrators only.

bash

# Example ModSecurity rule to block SQLi payloads targeting the aid parameter
SecRule ARGS:aid "@detectSQLi" \
  "id:1006274,\
   phase:2,\
   deny,\
   status:403,\
   msg:'CVE-2024-6274 SQLi attempt in attendancelist.php aid parameter',\
   tag:'CWE-89'"