CVE-2017-15989
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the sort parameter in the resources.php file of Online Exam Test Application. This affects all deployments of the vulnerable application version that expose the web interface. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- Online Exam Test Application
📦 What is this software?
Online Exam Test Application by Online Exam Test Application Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, exam result manipulation, user credential theft, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Public exploit available on Exploit-DB, requires no authentication, and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Review application source code for resources.php
2. Replace vulnerable SQL queries with parameterized prepared statements
3. Implement proper input validation for sort parameter
4. Test thoroughly before deployment
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns in sort parameter
Input Validation Filter
allAdd PHP filter to restrict sort parameter to allowed values only
$allowed_sort = ['asc', 'desc', 'name', 'date'];
if (!in_array($_GET['sort'], $allowed_sort)) {
$sort = 'default';
}
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from web server
🔍 How to Verify
Check if Vulnerable:
Test with payload: resources.php?action=category&sort=1' OR '1'='1Check Version:
Check application version in admin panel or source code commentsVerify Fix Applied:
Attempt SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests with SQL keywords in sort parameter
- Requests with single quotes or SQL operators in sort parameter
Network Indicators:
- HTTP requests containing SQL injection patterns in GET parameters
- Unusual database query patterns from web server IP
SIEM Query:
source="web_logs" AND (uri="*resources.php*" AND (param="*sort=*'*" OR param="*sort=*%27*" OR param="*sort=*OR*" OR param="*sort=*UNION*"))