CVE-2023-45120
📋 TL;DR
Online Examination System v1.0 contains an authenticated SQL injection vulnerability in the 'qid' parameter of the /update.php resource. This allows authenticated attackers to execute arbitrary SQL commands on the database. Organizations using this specific software version are affected.
💻 Affected Systems
- Online Examination System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution on the database server.
Likely Case
Unauthorized access to sensitive examination data, student records, and administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploitation requires valid user credentials. SQL injection techniques are well-documented and easily weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://projectworlds.in/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If available, backup database and application files. 3. Replace vulnerable files with patched version. 4. Test functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept numeric values for the 'qid' parameter
Modify update.php to include: if(!is_numeric($_GET['qid'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:qid "@rx [^0-9]" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable system
- Enable detailed logging and monitoring of all database queries from the application
🔍 How to Verify
Check if Vulnerable:
Test the /update.php?q=quiz&step=2 endpoint with SQL injection payloads in the qid parameter (requires authenticated session)Check Version:
Check application documentation or source code for version informationVerify Fix Applied:
Attempt SQL injection after applying fixes - should receive error or no database response📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web application user
- SQL syntax errors in application logs
- Multiple failed login attempts followed by successful authentication
Network Indicators:
- Unusual SQL patterns in HTTP requests to /update.php
- Database connections from web server with unusual query patterns
SIEM Query:
source="web_logs" AND uri="/update.php" AND (query="*UNION*" OR query="*SELECT*" OR query="*INSERT*" OR query="*DELETE*")