CVE-2023-30245
📋 TL;DR
This SQL injection vulnerability in Judging Management System v1.0 allows remote attackers to execute arbitrary SQL commands via the crit_id parameter in edit_criteria.php. Attackers can potentially read, modify, or delete database contents, and in some configurations execute operating system commands. All deployments of Judging Management System v1.0 are affected.
💻 Affected Systems
- Judging Management System
📦 What is this software?
Judging Management System by Judging Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including database destruction, credential theft, and remote code execution leading to full server takeover.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
SQL injection via GET parameter requires minimal technical skill. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries and input validation in edit_criteria.php. Replace raw SQL queries with prepared statements.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize crit_id parameter before processing
// In edit_criteria.php, add: if(!is_numeric($_GET['crit_id'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns in crit_id parameter
ModSecurity rule: SecRule ARGS:crit_id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict network access controls
- Implement database user with minimal privileges (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test with payload: edit_criteria.php?crit_id=1' OR '1'='1Check Version:
Check PHP files for version comments or database schema versionVerify Fix Applied:
Test with same payload - should return error or no SQL execution📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in PHP logs
- Multiple requests to edit_criteria.php with special characters in crit_id
Network Indicators:
- HTTP requests containing SQL keywords in crit_id parameter
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND uri="*edit_criteria.php*" AND (query="*crit_id=*'*" OR query="*crit_id=*%27*")