CVE-2024-6275: School Management System SQLi Vulnerability

CVE-2024-6275 Overview

CVE-2024-6275 is a SQL injection vulnerability in Lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the parent.php file within the Parent Page component. Attackers can manipulate the update argument to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely over the network but requires high privileges, meaning an authenticated user context is needed. Public disclosure of the exploit occurred alongside the CVE assignment, tracked as VulDB identifier VDB-269488. The weakness maps to CWE-89, Improper Neutralization of Special Elements used in a SQL Command.

Critical Impact
Authenticated attackers can inject SQL via the update parameter in parent.php, potentially disclosing, modifying, or deleting records in the school management database.

Affected Products

Lahirudanushka School Management System 1.0.0
Lahirudanushka School Management System 1.0.1
Component: parent.php (Parent Page)

Discovery Timeline

2024-06-24 - CVE-2024-6275 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6275

Vulnerability Analysis

The vulnerability exists in the Parent Page component implemented in parent.php. The update request parameter is concatenated into a SQL statement without proper sanitization or parameterized query binding. An authenticated attacker with access to the parent management functionality can submit crafted input that alters the intended query logic. Successful exploitation yields limited confidentiality, integrity, and availability impact against the backing database. Because the application ships with no known upstream patch, exposure persists until administrators remove or restrict the affected file.

Root Cause

The root cause is direct interpolation of user-controlled input into a SQL query string within parent.php. The code does not apply prepared statements, input allowlists, or type coercion to the update argument. This pattern is classic CWE-89 behavior and enables both in-band and inferential SQL injection techniques.

Attack Vector

Exploitation requires network access to the web application and valid credentials with parent-level access, since the CVSS vector indicates high privileges required (PR:H). The attacker submits an HTTP request to parent.php with a malicious update value that appends or modifies SQL clauses. No user interaction is needed. The public proof of concept documented in the Notion SQL Injection Overview describes the injection pattern against this endpoint.

No verified exploit code is available in a public repository. See the VulDB #269488 entry and the VulDB CTI record for further technical detail.

Detection Methods for CVE-2024-6275

Indicators of Compromise

HTTP requests targeting parent.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the update parameter.
Unexpected database errors or long-running queries originating from the Parent Page workflow.
Anomalous authenticated parent-account activity followed by bulk row reads or schema-enumeration queries.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the update parameter on parent.php for SQL injection payloads.
Enable database query logging and alert on parameterized-query bypass patterns such as tautologies (OR 1=1) or stacked queries.
Correlate authentication logs with subsequent injection attempts to identify compromised parent accounts.

Monitoring Recommendations

Ingest web server access logs and MySQL general query logs into a centralized analytics platform for behavioral baselining.
Monitor for outbound data transfer spikes from the database host following requests to parent.php.
Track failed login attempts on the parent portal to identify credential-stuffing attempts that precede exploitation.

How to Mitigate CVE-2024-6275

Immediate Actions Required

Restrict network access to the School Management System, exposing it only to trusted internal networks or via VPN.
Disable or remove the Parent Page functionality until code-level remediation is applied.
Rotate credentials for all parent-role accounts and enforce strong password policies.
Audit database logs for signs of prior exploitation attempts against parent.php.

Patch Information

No official vendor advisory or patch has been published for Lahirudanushka School Management System versions 1.0.0 and 1.0.1. Administrators should consult the VulDB submission record for updates and consider forking the application to apply parameterized queries in parent.php. Replace string concatenation with prepared statements using PDO or MySQLi with bound parameters.

Workarounds

Place the application behind a WAF with SQL injection signatures enabled and virtual-patch the update parameter.
Implement server-side input validation that restricts update to expected numeric or enumerated values.
Apply database-level least privilege so the web application account cannot execute DROP, ALTER, or cross-database queries.
Consider migrating to a supported school management platform if the vendor does not issue a fix.

bash

# Example WAF ModSecurity rule to block SQL injection payloads targeting parent.php
SecRule REQUEST_URI "@contains /parent.php" \
    "chain,phase:2,deny,status:403,id:1006275,msg:'CVE-2024-6275 SQLi attempt'"
    SecRule ARGS:update "@detectSQLi" "t:none,t:urlDecodeUni"