CVE-2021-46307
📋 TL;DR
This SQL injection vulnerability in Projectworlds Online Examination System 1.0 allows attackers to execute arbitrary SQL commands via the eid parameter in account.php. This can lead to unauthorized data access, modification, or deletion. Organizations using this specific version of the examination system are affected.
💻 Affected Systems
- Projectworlds Online Examination System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive student/exam data theft, system takeover, and potential lateral movement to other systems.
Likely Case
Unauthorized access to examination data, grade manipulation, and potential credential theft from the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
SQL injection via URL parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the eid parameter before processing SQL queries.
Implement parameterized queries or prepared statements in account.php
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns targeting the eid parameter.
Configure WAF to detect and block SQL injection patterns in URL parameters
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database server exposure
🔍 How to Verify
Check if Vulnerable:
Test the account.php endpoint with SQL injection payloads in the eid parameter (e.g., ' OR '1'='1).Check Version:
Check software version in admin panel or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error handling.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple failed login attempts with SQL patterns
Network Indicators:
- HTTP requests to account.php with SQL keywords in parameters
- Unusual database query patterns
SIEM Query:
source="web_logs" AND uri="*account.php*" AND (param="*eid=*OR*" OR param="*eid=*UNION*" OR param="*eid=*SELECT*")