CVE-2024-6279: School Management System SQLi Vulnerability

CVE-2024-6279 Overview

CVE-2024-6279 is a SQL injection vulnerability in Lahirudanushka School Management System versions 1.0.0 and 1.0.1. The flaw resides in the examresults-par.php file within the Exam Results Page component. Attackers can manipulate the sid parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely and requires only low-privilege authentication. Public disclosure of the exploit technique has occurred, increasing exposure risk for unpatched deployments. The issue is tracked as VDB-269492 and categorized under CWE-89.

Critical Impact
Authenticated remote attackers can execute arbitrary SQL statements against the underlying database, exposing student records, credentials, and administrative data.

Affected Products

Lahirudanushka School Management System 1.0.0
Lahirudanushka School Management System 1.0.1
Exam Results Page component (examresults-par.php)

Discovery Timeline

2024-06-24 - CVE-2024-6279 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6279

Vulnerability Analysis

The vulnerability exists in the exam results endpoint of the Lahirudanushka School Management System. The examresults-par.php script accepts a sid (session or student identifier) parameter from HTTP requests and concatenates it directly into a SQL query. Because the application performs no parameterized query binding and no input sanitization, attackers can inject SQL syntax to alter query logic. This allows extraction of arbitrary database contents, authentication bypass through UNION-based payloads, and potentially write operations depending on the database user's privileges. The EPSS score of 0.545% places it in the 43rd percentile for exploitation likelihood.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The sid argument reaches the database query construction path without validation, type-casting, or prepared statement binding. String concatenation of untrusted input into dynamic SQL is the underlying coding flaw.

Attack Vector

An attacker submits a crafted HTTP request to examresults-par.php with a malicious sid parameter value. The request travels over the network and requires only low-privilege authentication to reach the vulnerable endpoint. Typical payloads include boolean-based blind, UNION-based, or error-based SQL injection strings appended to the sid value. See the public write-up for exploitation details.

No verified code examples are available. The vulnerability mechanism is described in prose above; consult the VulDB entry #269492 for further technical detail.

Detection Methods for CVE-2024-6279

Indicators of Compromise

HTTP requests to /examresults-par.php containing SQL metacharacters such as single quotes, UNION SELECT, --, /*, or OR 1=1 in the sid parameter.
Database error messages returned to the client indicating malformed SQL syntax originating from the exam results page.
Unusual outbound data volume from the web application database following requests to the affected endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection patterns in the sid query string parameter.
Correlate web server access logs with database query logs to identify anomalous query structures originating from examresults-par.php.
Monitor for authentication events followed by high-volume database read operations from the same session.

Monitoring Recommendations

Enable verbose query logging on the backend database and alert on queries containing UNION operators sourced from the exam results endpoint.
Track HTTP 500 responses from examresults-par.php, which often indicate probing activity.
Baseline normal sid parameter values (numeric identifiers) and alert on deviations containing non-numeric content.

How to Mitigate CVE-2024-6279

Immediate Actions Required

Restrict network access to the School Management System to trusted networks or VPN users until a fix is applied.
Audit web server and database logs for prior exploitation attempts against examresults-par.php.
Rotate database credentials and any user credentials that may have been exposed through the affected page.

Patch Information

No vendor patch or advisory has been published at the time of NVD entry. Organizations running Lahirudanushka School Management System 1.0.0 or 1.0.1 should monitor the project repository for updates and consider replacing the affected component if no fix becomes available.

Workarounds

Apply input validation at a reverse proxy or WAF layer to enforce numeric-only values for the sid parameter.
Modify examresults-par.php locally to use prepared statements with bound parameters instead of string concatenation.
Restrict the database account used by the web application to read-only access on required tables to limit injection impact.

bash

# Example ModSecurity rule to block non-numeric sid values
SecRule ARGS:sid "!@rx ^[0-9]+$" \
  "id:1002790,\
   phase:2,\
   deny,\
   status:400,\
   msg:'Non-numeric sid parameter blocked (CVE-2024-6279)',\
   logdata:'sid=%{ARGS.sid}'"