CVE-2023-45111
📋 TL;DR
Online Examination System v1.0 contains unauthenticated SQL injection vulnerabilities in the feed.php resource's email parameter. Attackers can execute arbitrary SQL commands without authentication, potentially compromising the entire database. All deployments of this specific software version are affected.
💻 Affected Systems
- Online Examination System
📦 What is this software?
Online Examination System by Online Examination System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure, credential theft, and unauthorized access to examination data and user information.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
SQL injection via email parameter in feed.php requires no authentication and uses common SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://projectworlds.in/
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and parameterized queries for the email parameter in feed.php
Modify feed.php to use prepared statements with parameterized queries
Web Application Firewall
allDeploy WAF with SQL injection protection rules
Configure WAF to block SQL injection patterns in POST/GET parameters
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation and restrict database access to minimum required connections
🔍 How to Verify
Check if Vulnerable:
Test feed.php endpoint with SQL injection payloads in email parameter (e.g., email=test' OR '1'='1)Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify parameterized queries are implemented and SQL injection attempts return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts from single IP
- Database query patterns with SQL keywords in email parameter
Network Indicators:
- HTTP requests to feed.php with SQL injection patterns in parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/feed.php" AND (param="email" AND value MATCH "[';]|OR|UNION|SELECT")