Exploit
CVE-2024-9080

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Sep 22, 2024 / Updated: 58d ago

010
CVSS 6.9EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A critical vulnerability has been discovered in code-projects Student Record System 1.0. The vulnerability affects an unknown function in the file /pincode-verification.php. The issue arises from improper input validation, allowing manipulation of the 'pincode' argument, which can lead to SQL injection attacks. This vulnerability can be exploited remotely without requiring user interaction or special privileges.

Impact

If exploited, this SQL injection vulnerability could allow attackers to manipulate or retrieve sensitive data from the database, potentially compromising the confidentiality, integrity, and availability of the Student Record System. Attackers could potentially view, modify, or delete student records, insert malicious data, or execute unauthorized database operations. The CVSS v3.1 base score of 9.8 (Critical) indicates a severe risk, with potential for unauthorized data access, data manipulation, and system disruption.

Exploitation

Multiple proof-of-concept exploits are available on github.com, github.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the latest information provided, there is no mention of an available patch for this vulnerability in code-projects Student Record System 1.0. Users of this system should be on high alert and look for updates from the vendor.

Mitigation

While awaiting a patch, the following mitigation steps are recommended: 1. Implement strong input validation and sanitization for all user inputs, especially the 'pincode' parameter in /pincode-verification.php. 2. Use parameterized queries or prepared statements instead of concatenating user inputs directly into SQL queries. 3. Apply the principle of least privilege to database accounts used by the application. 4. Implement web application firewalls (WAF) to help detect and block SQL injection attempts. 5. Regularly monitor system logs for any suspicious activities or unauthorized access attempts. 6. If possible, consider temporarily disabling the affected functionality until a patch is available. 7. Keep the Student Record System and all associated components up to date with the latest security patches.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9080. See article

Sep 22, 2024 at 6:41 AM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 22, 2024 at 6:42 AM
CVE Assignment

NVD published the first details for CVE-2024-9080

Sep 22, 2024 at 7:15 AM
CVSS

A CVSS base score of 7.3 has been assigned.

Sep 22, 2024 at 7:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.3%)

Sep 23, 2024 at 10:47 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Sep 26, 2024 at 4:35 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Sep 26, 2024 at 7:11 PM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 28, 2024 at 9:36 PM / nvd
Static CVE Timeline Graph

Affected Systems

Code-projects/student_record_system
+null more

Exploits

https://github.com/nothe1senberg/CVE-2024-9080
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

CVE-2024-9080 Exploit
CVE Id : CVE-2024-9080 Published Date: 2024-09-26T16:32:00+00:00 A vulnerability was found in code-projects Student Record System 1.0. It has been classified as critical. Affected is an unknown function of the file /pincode-verification.php. The manipulation of the argument pincode leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. inTheWild added a link to an exploit: https://github.com/ppp-src/a/issues/17
CVE Alert: CVE-2024-9080 - https://www.redpacketsecurity.com/cve_alert_cve-2024-9080/ #OSINT #ThreatIntel #CyberSecurity #cve_2024_9080
CVE Alert: CVE-2024-9080 - redpacketsecurity.com/cve_al… #OSINT #ThreatIntel #CyberSecurity #cve_2024_9080
CVE Alert: CVE-2024-9080
Affected is an unknown function of the file /pincode-verification.php. Affected Endpoints:
CVE-2024-9080
Critical Severity Description A vulnerability was found in code-projects Student Record System 1.0. It has been classified as critical. Affected is an unknown function of the file /pincode-verification.php. The manipulation of the argument pincode leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Read more at https://www.tenable.com/cve/CVE-2024-9080
NA - CVE-2024-9080 - A vulnerability was found in code-projects...
A vulnerability was found in code-projects Student Record System 1.0. It has been classified as critical. Affected is an unknown function of the file /pincode-verification.php. The manipulation of...
See 10 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI