CVE-2023-45117
📋 TL;DR
Online Examination System v1.0 contains an authenticated SQL injection vulnerability in the 'eid' parameter of the /update.php?q=rmquiz endpoint. This allows authenticated attackers to execute arbitrary SQL commands on the database. Organizations using this specific software version are affected.
💻 Affected Systems
- Online Examination System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, privilege escalation, or remote code execution on the database server.
Likely Case
Unauthorized access to sensitive examination data, student records, and system credentials stored in the database.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, restricting attackers to data within their permission scope.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward using SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://projectworlds.in/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If available, backup database and application files. 3. Replace vulnerable files with patched version. 4. Test functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept numeric values for the 'eid' parameter
Modify update.php to include: if(!is_numeric($_GET['eid'])) { die('Invalid parameter'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the /update.php endpoint
WAF-specific configuration to block SQL patterns in query parameters
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the examination system from sensitive networks
- Enable detailed logging and monitoring of database queries from the application
🔍 How to Verify
Check if Vulnerable:
Test the /update.php?q=rmquiz endpoint with SQL injection payloads in the 'eid' parameter while authenticatedCheck Version:
Check application files or documentation for version informationVerify Fix Applied:
Attempt SQL injection after applying fixes and verify error responses or blocked requests📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from application user
- SQL syntax errors in application logs
- Multiple failed login attempts followed by SQL injection attempts
Network Indicators:
- SQL keywords in HTTP GET parameters
- Unusual database port traffic from web server
SIEM Query:
source="web_logs" AND uri="/update.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "INSERT")