CVE-2024-31545

An attacker sends a crafted HTTP request to the endpoint /admin/?page=user/manage_user&id=6, injecting malicious SQL code into the 'id' parameter. The application does not validate or sanitize input data before passing it to the database query (CWE-89). Since access to the vulnerable endpoint does not require authentication, the exploit can be performed by anyone with network access to the system. A public proof-of-concept (PoC) is available documenting how to exploit the vulnerability.

An attacker can gain unauthorized access to database contents (user data, credentials) and modify or delete data stored in the system. Depending on the database server configuration, it is also possible to escalate the attack to execute system commands.

Apply patches available from the manufacturer according to the references. As a temporary workaround, it is recommended to restrict access to the administration panel exclusively to trusted IP addresses and enforce authentication on all protected resources. It is also recommended to use parameterized SQL queries (prepared statements) in the application code.

Computer Laboratory Management System v1.0 (Oretnom23 product)