CVE-2023-1591
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Automatic Question Paper Generator System 1.0 allows attackers to manipulate database queries through the id/email parameters in the Users.php file. Remote attackers can potentially access, modify, or delete sensitive data in the database. All users running the vulnerable version are affected.
💻 Affected Systems
- SourceCodester Automatic Question Paper Generator System
📦 What is this software?
Automatic Question Paper Generator System by Automatic Question Paper Generator System Project
View all CVEs affecting Automatic Question Paper Generator System →
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of all user credentials, question papers, and system data; potential for authentication bypass and remote code execution.
Likely Case
Data exfiltration of user information, question papers, and system configuration; potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions; SQL injection attempts logged and blocked.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with standard tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries or input validation in classes/Users.php file.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
Input Validation
allImplement server-side validation for id and email parameters to reject malicious input.
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only.
- Implement strict network segmentation and monitor all traffic to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /classes/Users.php?f=save_ruser with SQL injection payloads in id or email parameters.Check Version:
Check system documentation or configuration files for version information.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts with SQL syntax in parameters
- Access to Users.php with suspicious parameters
Network Indicators:
- HTTP requests to /classes/Users.php containing SQL keywords like UNION, SELECT, OR 1=1
SIEM Query:
source="web_logs" AND uri="/classes/Users.php" AND (query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*OR 1=1*")