CVE-2024-31546

An attacker sends a crafted HTTP request to the /admin/damage/view_damage.php endpoint, injecting malicious SQL code into the 'id' parameter. The application does not properly validate or filter input data, so the injected code is executed directly by the database engine. The lack of authentication requirement (PR:N) and low attack complexity (AC:L) make the exploit executable without any special prerequisites.

An attacker can gain unauthorized access to all data stored in the database (confidentiality), modify or delete data (integrity), and in certain configurations cause system unavailability (availability). It is also possible to steal authentication credentials to the system and take over administrator accounts.

Patches available from the vendor should be applied according to the references. Until the fix is implemented, it is recommended to restrict access to the administration panel (/admin/) at the firewall or web server level and implement parameterized SQL queries (prepared statements) in the application code.

Computer Laboratory Management System v1.0 by Oretnom23