CVE-2021-37803
📋 TL;DR
This SQL injection vulnerability in the Online Covid Vaccination Scheduler System allows attackers to execute arbitrary SQL commands through the username field in login.php. This affects all users of version 1.0 who have the system exposed to untrusted networks, potentially leading to data theft or system compromise.
💻 Affected Systems
- Sourcecodester Online Covid Vaccination Scheduler System
📦 What is this software?
Online Covid Vaccination Scheduler System by Online Covid Vaccination Scheduler System Project
View all CVEs affecting Online Covid Vaccination Scheduler System →
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of sensitive medical records, user credentials, and administrative access to the entire system.
Likely Case
Unauthorized access to vaccination scheduling data, user information, and potential privilege escalation to administrative functions.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or failed login attempts.
🎯 Exploit Status
Public exploit code exists and requires no authentication, making this easily exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allImplement proper input validation and use prepared statements/parameterized queries in login.php
Modify login.php to use PDO or mysqli prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Configure WAF to block SQL injection patterns in login requests
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation and restrict database access to only necessary services
🔍 How to Verify
Check if Vulnerable:
Test login.php with SQL injection payloads in username field (e.g., admin' OR '1'='1)Check Version:
Check system version in admin panel or configuration filesVerify Fix Applied:
Test with same payloads and verify they are rejected or properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple failed login attempts with SQL syntax
Network Indicators:
- HTTP POST requests to login.php containing SQL keywords in username parameter
SIEM Query:
source="web_logs" AND uri="/login.php" AND (username CONTAINS "' OR" OR username CONTAINS "UNION" OR username CONTAINS "SELECT")