CVE-2020-8519
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in the search parameter of Records.php in phpzag's 'Live Add Edit Delete DataTables Records with Ajax PHP MySQL' script. Attackers can execute arbitrary SQL commands, potentially compromising the entire database. Any website using this vulnerable script is affected.
💻 Affected Systems
- phpzag Live Add Edit Delete DataTables Records with Ajax PHP MySQL
📦 What is this software?
Phpzag by Phpzag
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions.
🎯 Exploit Status
SQL injection via search parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Updated script from phpzag website
Vendor Advisory: https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/
Restart Required: No
Instructions:
1. Download updated script from phpzag.com 2. Replace vulnerable Records.php file 3. Test functionality 4. Deploy to production
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize search parameter before processing
Add input filtering in Records.php: $search = filter_var($_POST['search'], FILTER_SANITIZE_STRING);
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:search "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in Records.php
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Test search parameter with SQL injection payloads like ' OR '1'='1Check Version:
Check file modification dates and compare with known vulnerable versionsVerify Fix Applied:
Test with same payloads and verify they are properly sanitized or rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts after search queries
- Suspicious search parameters containing SQL keywords
Network Indicators:
- HTTP POST requests to Records.php with SQL injection patterns in search parameter
SIEM Query:
source="web_logs" AND uri="/Records.php" AND (search="*OR*" OR search="*UNION*" OR search="*SELECT*" OR search="*INSERT*")🔗 References
- http://www.openwall.com/lists/oss-security/2020/07/09/1
- http://www.vapidlabs.com/advisory.php?v=213
- https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/
- http://www.openwall.com/lists/oss-security/2020/07/09/1
- http://www.vapidlabs.com/advisory.php?v=213
- https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/
