CVE-2018-17575
📋 TL;DR
CVE-2018-17575 is a SQL injection vulnerability in SWA.JACAD academic software that allows attackers to execute arbitrary SQL commands via the studentId parameter in the password recovery function. This affects all users of SWA Sistemas Acadêmicos version 3.1.37 Build 024. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- SWA Sistemas Acadêmicos (SWA.JACAD)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover through privilege escalation.
Likely Case
Unauthorized access to student records, personal information, and academic data stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
SQL injection via URL parameter requires minimal technical skill. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact SWA Sistemas for updated version or implement workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
Input Validation Filter
allImplement server-side input validation to reject malicious SQL characters in studentId parameter.
🧯 If You Can't Patch
- Block external access to /academico/aluno/esqueci-minha-senha/ endpoint at network firewall.
- Implement database user with minimal permissions (read-only if possible) for the application.
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads like: /academico/aluno/esqueci-minha-senha/?studentId=1' OR '1'='1Check Version:
Check application version in admin interface or configuration files (typically 3.1.37 Build 024).Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return appropriate error messages or are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts via password recovery endpoint
- Requests containing SQL keywords (SELECT, UNION, etc.) in studentId parameter
Network Indicators:
- HTTP requests to /academico/aluno/esqueci-minha-senha/ with suspicious parameters
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND uri="/academico/aluno/esqueci-minha-senha/" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR*1*1*")