CVE-2024-12609 in School Management System Plugin
Summary
by MITRE • 03/07/2025
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all versions up to, and including, 92.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the mj_smgt_view_student_attendance() function. This makes it possible for authenticated attackers, with Student-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/07/2025
The School Management System for WordPress plugin presents a critical SQL injection vulnerability that compromises database integrity and exposes sensitive information. This vulnerability exists within the mj_smgt_view_student_attendance() function where the plugin fails to properly sanitize user input parameters. The flaw specifically affects all versions up to and including 92.0.0, creating a persistent security risk for organizations relying on this educational management platform. The vulnerability occurs on the 'view-attendance' page where unescaped user-supplied parameters are directly incorporated into SQL queries without proper preparation or validation mechanisms.
The technical implementation of this vulnerability stems from inadequate input validation and parameter sanitization within the plugin's core functionality. When authenticated users with Student-level access or higher attempt to access the attendance viewing feature, the system processes their input without sufficient escaping mechanisms. This allows malicious actors to inject additional SQL commands that become part of the existing query structure. The lack of proper SQL query preparation techniques means that user input is treated as executable code rather than data, creating a direct pathway for database manipulation. This vulnerability aligns with CWE-89 which categorizes SQL injection flaws as improper neutralization of special elements used in SQL commands.
The operational impact of this vulnerability extends beyond simple data extraction to potentially enable full database compromise. Authenticated attackers can leverage this weakness to retrieve sensitive information including student records, personal identification details, and institutional data that should remain protected. The vulnerability's accessibility through Student-level accounts demonstrates a significant privilege escalation risk where lower-privileged users can access data beyond their intended permissions. This represents a serious breach of the principle of least privilege and could lead to privacy violations, data theft, and potential regulatory compliance issues under various data protection frameworks.
Organizations utilizing this plugin must implement immediate mitigation strategies to protect their educational data systems. The most effective immediate solution involves updating to the latest plugin version where the SQL injection vulnerability has been patched and properly addressed. System administrators should also consider implementing additional security measures including database query monitoring, input validation enforcement, and access control reviews. The ATT&CK framework categorizes this vulnerability under T1071.004 for application layer protocol and T1046 for network service scanning, indicating that attackers could use this weakness as part of broader reconnaissance activities. Organizations should also conduct thorough security assessments of their WordPress installations to identify similar vulnerabilities in other plugins or themes that may present similar attack vectors.