CVE-2024-45622 Scanner

ASIS, also known as Aplikasi Sistem Sekolah, is a school system management application built using CodeIgniter 3. It is widely used by educational institutions to streamline processes such as attendance, grading, and student data management. The software provides a centralized platform for educators, administrators, and students to access and manage school activities and records efficiently. ASIS enhances communication within school environments by providing various modules that cater to different administrative needs. Its ability to integrate with other educational tools makes it a versatile solution for schools seeking digital transformation. The platform is designed to be user-friendly, making it accessible even for those with limited technical knowledge.

The SQL Injection vulnerability identified in ASIS arises from improper input validation in the login process. This flaw allows malicious users to manipulate the SQL queries, enabling authentication bypass without valid credentials. Exploiting this vulnerability, attackers can gain unauthorized administrative access, compromising the entire system’s data security. The risk level is critical as it could lead to data breaches and unauthorized data manipulation. SQL Injection exploits can be executed remotely, and attackers often use automated tools to identify and exploit such vulnerabilities quickly. This makes the vulnerability a significant threat to any systems running vulnerable versions.

The vulnerability focuses on the 'index.php' page within the login functionality of ASIS. Specifically, the 'username' parameter is susceptible to injection attacks. By injecting SQL payloads into the login form, attackers can trick the system into bypassing authentication checks. The vulnerability exists due to insufficient sanitization of input data within the login script, which should be validated and escaped to prevent SQL Injection. The endpoint accepts unsanitized user input, which directly influences SQL queries executed on the database. Utilizing such a flaw, attackers can execute arbitrary database commands, potentially leading to full system compromise.

Exploiting this SQL Injection vulnerability can have severe consequences for affected institutions using ASIS. Attackers can bypass authentication measures to access sensitive school data, including student records, teacher information, and administrative records. Altering or deleting critical data may disrupt school operations significantly, leading to a loss of trust and potential legal implications concerning data protection laws. Moreover, unauthorized access could facilitate the installation of malicious software, further compromising network security and opening doors for subsequent attacks. Restoring affected systems can be time-consuming and costly, not to mention potential reputational damage.

REFERENCES

• https://github.com/atoz-chevara/cve/blob/main/2024/ASIS_AplikasiSistemSekolah_Using_CodeIgniter3-SQL_Injection_Authentication_Bypass.md
• https://packetstormsecurity.com/files/181355/ASIS-3.2.0-SQL-Injection.html
• https://nvd.nist.gov/vuln/detail/CVE-2024-45622