CVE-2023-30204
📋 TL;DR
Judging Management System v1.0 contains a SQL injection vulnerability in the edit_judge.php endpoint via the judge_id parameter. This allows attackers to execute arbitrary SQL commands on the database, potentially compromising the entire system. All installations of version 1.0 are affected.
💻 Affected Systems
- Judging Management System
📦 What is this software?
Judging Management System by Judging Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing exploitation.
🎯 Exploit Status
Simple SQL injection via GET/POST parameter. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Implement workarounds or migrate to alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to ensure judge_id parameter contains only numeric values
In edit_judge.php, add: if(!is_numeric($_GET['judge_id'])) { die('Invalid input'); }
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:judge_id "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from web server
🔍 How to Verify
Check if Vulnerable:
Test with payload: /php-jms/edit_judge.php?judge_id=1' OR '1'='1Check Version:
Check version in application interface or readme filesVerify Fix Applied:
Test with same payload - should return error or no data instead of executing SQL📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in PHP logs
- Multiple requests to edit_judge.php with SQL-like parameters
Network Indicators:
- HTTP requests containing SQL keywords in judge_id parameter
- Unusual database query patterns from web server IP
SIEM Query:
source="web_logs" AND uri="/php-jms/edit_judge.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*'*'*'*")