CVE-2023-23162
📋 TL;DR
This SQL injection vulnerability in Art Gallery Management System v1.0 allows attackers to execute arbitrary SQL commands via the cid parameter in product.php. This can lead to data theft, authentication bypass, or complete system compromise. Anyone running this specific version of the software is affected.
💻 Affected Systems
- Art Gallery Management System Project
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, authentication bypass, privilege escalation, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access, modification, or deletion of gallery content, user data, and potentially administrative credentials.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Public exploit code exists on Packet Storm Security and GitHub; exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Replace vulnerable product.php with secure version using parameterized queries or migrate to supported software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation to sanitize the cid parameter before processing.
Modify product.php to validate cid as integer: if(!is_numeric($_GET['cid'])) { die('Invalid input'); }
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns in requests.
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only.
- Implement strict network segmentation and monitor all database queries for anomalies.
🔍 How to Verify
Check if Vulnerable:
Test product.php with malicious cid parameter (e.g., product.php?cid=1' OR '1'='1) and check for SQL errors or unexpected behavior.Check Version:
Check project files or documentation for version 1.0 reference; no built-in version command.Verify Fix Applied:
After applying workarounds, retest with same malicious inputs; should return error or sanitized response without SQL execution.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple rapid requests to product.php with varying cid parameters
- Database queries containing SQL keywords from web input
Network Indicators:
- HTTP requests to product.php with SQL injection patterns in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="*product.php*" AND (param="*cid=*'*" OR param="*cid=*%27*")🔗 References
- http://packetstormsecurity.com/files/171643/Art-Gallery-Management-System-Project-1.0-SQL-Injection.html
- https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-23162/CVE-2023-23162.txt
- https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/
- https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
- http://packetstormsecurity.com/files/171643/Art-Gallery-Management-System-Project-1.0-SQL-Injection.html
- https://github.com/rahulpatwari/CVE/blob/main/CVE-2023-23162/CVE-2023-23162.txt
- https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/
- https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
