CVE-2021-45334
📋 TL;DR
CVE-2021-45334 is a critical SQL injection vulnerability in Sourcecodester Online Thesis Archiving System 1.0 that allows unauthenticated attackers to bypass admin authentication and gain administrative access. This affects all deployments of version 1.0 of this specific software. Attackers can compromise the entire system through this authentication bypass.
💻 Affected Systems
- Sourcecodester Online Thesis Archiving System
📦 What is this software?
Online Thesis Archiving System by Online Thesis Archiving System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise: attackers gain admin access, can steal all thesis data, modify/delete content, execute arbitrary SQL commands, and potentially achieve remote code execution.
Likely Case
Administrative account takeover leading to data theft, system manipulation, and potential lateral movement within the network.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Multiple public exploit scripts available. Attack requires no authentication and uses simple SQL injection payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - No official patch released by vendor
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Check vendor website for updates 2. If no patch available, implement workarounds 3. Consider migrating to alternative software
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries in login/auth functions
Modify PHP files to use prepared statements: $stmt = $conn->prepare('SELECT * FROM users WHERE username = ? AND password = ?'); $stmt->bind_param('ss', $username, $password);
Web Application Firewall (WAF)
allDeploy WAF with SQL injection rules to block malicious payloads
Install and configure ModSecurity with OWASP CRS rules
Enable SQL injection detection rules in cloud WAF services
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input filtering
- Implement network segmentation to limit lateral movement if compromised
🔍 How to Verify
Check if Vulnerable:
Test login page with SQL injection payloads like: admin' OR '1'='1Check Version:
Check system version in admin panel or review source code for version markersVerify Fix Applied:
Attempt SQL injection attacks against authentication endpoints; successful login should be blocked📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with SQL keywords
- Successful admin login from unusual IP addresses
- SQL error messages in application logs
Network Indicators:
- HTTP POST requests to login.php containing SQL keywords
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND (uri="/login.php" OR uri="/admin/login.php") AND (body="OR '1'='1" OR body="UNION SELECT" OR body="--" OR body="#")🔗 References
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-45334
- https://packetstormsecurity.com/files/165272/Online-Thesis-Archiving-System-1.0-SQL-Injection-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/50597
- https://www.nu11secur1ty.com/2022/01/cve-2021-45334.html
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-45334
- https://packetstormsecurity.com/files/165272/Online-Thesis-Archiving-System-1.0-SQL-Injection-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/50597
- https://www.nu11secur1ty.com/2022/01/cve-2021-45334.html
