CVE-2023-45119
📋 TL;DR
Online Examination System v1.0 contains an authenticated SQL injection vulnerability in the 'n' parameter of the /update.php?q=quiz endpoint. This allows authenticated attackers to execute arbitrary SQL commands on the database. Organizations using this specific software version are affected.
💻 Affected Systems
- Online Examination System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation to administrative access, and potential remote code execution on the database server.
Likely Case
Unauthorized access to sensitive student/exam data, grade manipulation, and potential extraction of administrator credentials from the database.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing within the attacker's privilege scope.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://projectworlds.in/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If available, backup database and application files. 3. Replace vulnerable files with patched version. 4. Test functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'n' parameter before database queries
Modify update.php to validate 'n' parameter as integer using is_numeric() or similar function
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule to detect and block SQL injection attempts on /update.php endpoint
🧯 If You Can't Patch
- Implement strict input validation for all parameters in the application
- Restrict database user permissions to minimum required, use prepared statements, and enable database logging
🔍 How to Verify
Check if Vulnerable:
Test the /update.php?q=quiz endpoint with SQL injection payloads in the 'n' parameter while authenticatedCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Attempt SQL injection tests after implementing fixes and verify they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web application user
- Multiple failed login attempts followed by SQL error messages
- SQL syntax errors in application logs
Network Indicators:
- HTTP requests to /update.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/update.php" AND (param="n" AND value MATCH "(?i)(union|select|insert|update|delete|drop|--|#|;)")