CVE-2023-31845
📋 TL;DR
CVE-2023-31845 is an SQL injection vulnerability in Sourcecodester Faculty Evaluation System v1.0, allowing attackers to execute arbitrary SQL commands via the 'id' parameter in /eval/admin/manage_class.php. This affects all users running the vulnerable version, potentially compromising database integrity and confidentiality.
💻 Affected Systems
- Sourcecodester Faculty Evaluation System
📦 What is this software?
Faculty Evaluation System by Faculty Evaluation System Project
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise leading to data theft, unauthorized access, or complete system takeover.
Likely Case
Data exfiltration, such as stealing user credentials or sensitive information from the database.
If Mitigated
Limited impact if input validation and parameterized queries are enforced, preventing SQL execution.
🎯 Exploit Status
Exploitation is straightforward via crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not known
Restart Required: No
Instructions:
No official patch; apply workarounds or upgrade if a newer version is released.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation to sanitize the 'id' parameter, rejecting malicious inputs.
Modify PHP code to use prepared statements, e.g., $stmt = $conn->prepare('SELECT * FROM classes WHERE id = ?'); $stmt->bind_param('i', $id);
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns in requests to /eval/admin/manage_class.php.
Configure WAF to detect and block SQL keywords like UNION, SELECT, OR 1=1 in URL parameters.
🧯 If You Can't Patch
- Restrict access to the vulnerable endpoint using network ACLs or authentication.
- Monitor and log all access to /eval/admin/manage_class.php for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Send a test request to /eval/admin/manage_class.php?id=1' OR '1'='1 and check for SQL errors or unexpected responses.Check Version:
Check the application's version in its documentation or configuration files; no standard command available.Verify Fix Applied:
After applying workarounds, retest with the same payload; it should return an error or no data without executing SQL.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs, repeated requests with SQL-like parameters to manage_class.php.
Network Indicators:
- HTTP requests containing SQL injection payloads in the 'id' parameter.
SIEM Query:
Example: source="web_logs" AND uri="/eval/admin/manage_class.php" AND (param="id" AND value MATCHES "'.*OR.*'" OR value MATCHES "'.*UNION.*'");