CVE-2023-33584
📋 TL;DR
CVE-2023-33584 is a critical SQL injection vulnerability in Sourcecodester Enrollment System Project V1.0 that allows attackers to bypass authentication and execute arbitrary SQL commands. This affects all deployments using the vulnerable version, potentially exposing sensitive enrollment data and system access.
💻 Affected Systems
- Sourcecodester Enrollment System Project
📦 What is this software?
Enrollment System by Enrollment System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including data exfiltration, privilege escalation, and potential remote code execution via database functions.
Likely Case
Authentication bypass leading to unauthorized access to enrollment data, student records, and administrative functions.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to data viewing only.
🎯 Exploit Status
Multiple public exploit scripts available requiring minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch exists. Replace with secure alternative or implement custom fixes.
🔧 Temporary Workarounds
Input Validation Implementation
allAdd parameterized queries and input sanitization to login.php
Modify login.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM users WHERE username = ? AND password = ?'); $stmt->bind_param('ss', $username, $password);
Web Application Firewall Rules
allBlock SQL injection patterns at WAF level
Add WAF rule: SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt'"
🧯 If You Can't Patch
- Isolate system behind VPN with strict access controls
- Implement network segmentation and monitor for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test login page with SQL injection payload: ' OR '1'='1 in username fieldCheck Version:
Check source code files for version markers or review project documentationVerify Fix Applied:
Attempt SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in access logs
- Multiple failed login attempts with SQL characters
- Successful logins from unexpected IPs
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, INSERT)
- Abnormal database query patterns
SIEM Query:
source="web_logs" AND ("' OR" OR "UNION SELECT" OR "--" OR ";--")🔗 References
- http://packetstormsecurity.com/files/172718/Enrollment-System-Project-1.0-Authentication-Bypass-SQL-Injection.html
- https://github.com/sudovivek/My-CVE/blob/main/CVE-2023-33584_exploit.md
- https://packetstormsecurity.com/files/cve/CVE-2023-33584
- https://www.exploit-db.com/exploits/51501
- https://www.sourcecodester.com/php/14444/enrollment-system-project-source-code-using-phpmysql.html
- http://packetstormsecurity.com/files/172718/Enrollment-System-Project-1.0-Authentication-Bypass-SQL-Injection.html
- https://github.com/sudovivek/My-CVE/blob/main/CVE-2023-33584_exploit.md
- https://packetstormsecurity.com/files/cve/CVE-2023-33584
- https://www.exploit-db.com/exploits/51501
- https://www.sourcecodester.com/php/14444/enrollment-system-project-source-code-using-phpmysql.html
