CVE-2023-36311
📋 TL;DR
This SQL injection vulnerability in PHPJabbers Document Creator v1.0 allows attackers to execute arbitrary SQL commands via the 'column' parameter in index.php. This affects all users running the vulnerable version, potentially leading to data theft, modification, or complete system compromise.
💻 Affected Systems
- PHPJabbers Document Creator
📦 What is this software?
Document Creator by Phpjabbers
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized database access allowing data theft, modification of documents, and potential administrative account takeover.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
SQL injection via GET parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.phpjabbers.com/document-creator
Restart Required: No
Instructions:
1. Check vendor website for updates
2. If no patch available, implement workarounds
3. Consider replacing with alternative software
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'column' parameter before processing
Modify index.php to validate column parameter using preg_match('/^[a-zA-Z0-9_]+$/', $_GET['column']) or similar
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Implement strict input validation for all user-supplied parameters
- Restrict database user permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Test index.php with malicious column parameter like: index.php?column=1' OR '1'='1Check Version:
Check PHPJabbers Document Creator version in admin panel or configuration filesVerify Fix Applied:
Test with same payload after implementing fixes - should return error or sanitized response📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in logs
- Multiple requests with SQL keywords in parameters
- Requests to index.php with suspicious column values
Network Indicators:
- HTTP requests containing SQL injection patterns in GET parameters
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND (uri="*index.php*" AND query="*column=*'*" OR query="*column=*%27*")