CVE-2024-6956: University Management System SQLi Flaw

CVE-2024-6956 Overview

CVE-2024-6956 is a SQL injection vulnerability in itsourcecode University Management System 1.0. The flaw resides in the /view_cgpa.php script, where the VR and VN parameters are passed directly into a database query without proper sanitization. An authenticated remote attacker can manipulate these parameters to inject arbitrary SQL statements. The exploit has been publicly disclosed under identifier VDB-272078, increasing the likelihood of opportunistic exploitation against exposed installations. The weakness is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote attackers with low-privilege access can inject SQL statements through the VR and VN parameters in /view_cgpa.php, potentially exposing or modifying student, faculty, and grade records stored in the backend database.

Affected Products

Angeljudesuarez University Management System 1.0
itsourcecode University Management System (as distributed)
Deployments using /view_cgpa.php with vulnerable VR/VN parameter handling

Discovery Timeline

2024-07-21 - CVE-2024-6956 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6956

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the University Management System's grade-point-average viewing functionality. The /view_cgpa.php endpoint accepts user-supplied VR and VN parameters and incorporates them into a SQL query without parameterized statements or input validation. Because the query is constructed via string concatenation, attacker-controlled input alters the query's logic. The attack can be launched over the network and requires only low privileges, meaning any authenticated user of the application can trigger it. Attackers can extract records using UNION-based payloads, enumerate the schema through error-based techniques, or exfiltrate data using time-based blind injection.

Root Cause

The root cause is improper neutralization of special characters in SQL commands, tracked as [CWE-89]. The developer used direct interpolation of the VR and VN request parameters into the SQL statement, bypassing prepared statements. No allowlist validation, type coercion, or escaping is performed before the query reaches the database driver. This allows metacharacters such as single quotes, comments, and stacked query separators to break out of the intended query context.

Attack Vector

Exploitation requires network access to the web application and a valid low-privileged session. An attacker submits a crafted HTTP request to /view_cgpa.php with malicious content in the VR or VN argument. Because the exploit has been publicly disclosed on VulDB (identifier 272078) and via a GitHub proof-of-concept writeup, automated scanners and opportunistic attackers can reproduce it with minimal effort. Refer to the linked references for the specific injection payloads and query patterns.

Detection Methods for CVE-2024-6956

Indicators of Compromise

HTTP requests to /view_cgpa.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or SELECT in the VR or VN parameters.
Web server or PHP error logs referencing MySQL syntax errors originating from view_cgpa.php.
Unusual database query patterns targeting information_schema or user/credential tables from the application's service account.
Spikes in response latency on /view_cgpa.php consistent with time-based blind SQL injection probing.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect VR and VN parameters for SQL keywords and encoded payloads.
Enable database query logging and alert on queries referencing the CGPA view logic that contain UNION SELECT, boolean tautologies, or comment sequences.
Correlate authenticated session activity with anomalous query volumes originating from the application's PHP worker processes.

Monitoring Recommendations

Continuously monitor access logs for repeated requests to /view_cgpa.php from a single source IP with varying parameter payloads.
Ingest webserver, PHP, and MySQL logs into a centralized SIEM to enable cross-source correlation of injection attempts.
Track authentication events to detect low-privileged accounts being used to probe backend data through the CGPA endpoint.

How to Mitigate CVE-2024-6956

Immediate Actions Required

Restrict network access to the University Management System application until a patched build is deployed, exposing it only to trusted networks or via VPN.
Audit /view_cgpa.php and any related scripts for direct interpolation of request parameters into SQL queries, and rewrite them to use prepared statements.
Rotate database credentials used by the application if injection attempts against VR or VN are observed in logs.
Review database service account permissions and enforce least privilege so the web application cannot read or modify unrelated tables.

Patch Information

At the time of publication, no official vendor advisory is listed in the NVD entry for CVE-2024-6956. Community-supplied fix guidance is available in the VulDB entry #272078 and the GitHub writeup for the issue. Administrators should apply the recommended code changes, replace concatenated queries with parameterized queries, and validate the fix in a staging environment before production rollout.

Workarounds

Place the application behind a WAF configured to block SQL injection patterns on the VR and VN parameters of /view_cgpa.php.
Implement server-side input validation that restricts VR and VN to expected numeric or alphanumeric formats before the query executes.
Disable or remove the vulnerable CGPA viewing endpoint if it is not essential to business operations until a code-level fix is in place.

bash

# Example ModSecurity rule to block SQLi patterns targeting view_cgpa.php
SecRule REQUEST_URI "@contains /view_cgpa.php" \
    "phase:2,chain,deny,status:403,id:1006956,\
    msg:'Potential SQL Injection targeting CVE-2024-6956'"
    SecRule ARGS:VR|ARGS:VN "@rx (?i)(union(\s|/\*.*?\*/)+select|sleep\(|--|';|/\*|xp_)" \
        "t:none,t:urlDecodeUni"