CVE-2020-36084
📋 TL;DR
This SQL injection vulnerability in Responsive E-Learning System 1.0 allows remote attackers to execute arbitrary SQL commands through the 'id' parameter in delete_teacher_students.php. Attackers can potentially read, modify, or delete database content. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester Responsive E-Learning System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to specific tables.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Download latest version from vendor if available. 2. Replace vulnerable files. 3. Test functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure 'id' parameter contains only numeric values
In delete_teacher_students.php, add: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns in the 'id' parameter
WAF rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Block external access to /elearning/delete_teacher_students.php via firewall rules
- Implement database user with minimal permissions (read-only where possible)
🔍 How to Verify
Check if Vulnerable:
Test with payload: /elearning/delete_teacher_students.php?id=1' OR '1'='1Check Version:
Check application files for version information or readme.txtVerify Fix Applied:
Attempt SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to delete_teacher_students.php with special characters
Network Indicators:
- HTTP requests containing SQL keywords in 'id' parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/elearning/delete_teacher_students.php" AND (query CONTAINS "'" OR query CONTAINS "OR" OR query CONTAINS "UNION")