CVE-2023-45325
📋 TL;DR
Online Food Ordering System v1.0 contains unauthenticated SQL injection vulnerabilities in the routers/add-users.php endpoint. Attackers can exploit the 'address' parameter to execute arbitrary SQL commands without authentication, potentially compromising the entire database. All deployments of this specific software version are affected.
💻 Affected Systems
- Online Food Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential remote code execution through database functions.
Likely Case
Database information disclosure, credential theft, and potential privilege escalation leading to system compromise.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
SQL injection is well-understood with many automated tools available. The unauthenticated nature makes exploitation trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If no patch exists, implement input validation and parameterized queries. 3. Replace vulnerable code with secure alternatives.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
Input Validation Filter
allImplement server-side input validation to reject suspicious characters in the address parameter.
🧯 If You Can't Patch
- Block external access to the vulnerable endpoint using firewall rules or web server configuration.
- Implement database-level protections: use least privilege accounts, enable query logging, and restrict database functions.
🔍 How to Verify
Check if Vulnerable:
Send a test payload to /routers/add-users.php with SQL injection in the address parameter and check for database errors or unexpected responses.Check Version:
Check the software version in the admin panel or configuration files.Verify Fix Applied:
Test the same payload after remediation; it should return an error message or be blocked without executing SQL commands.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple rapid requests to /routers/add-users.php
- Requests containing SQL keywords like UNION, SELECT, INSERT in parameters
Network Indicators:
- HTTP requests to /routers/add-users.php with SQL syntax in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/routers/add-users.php" AND (param="address" AND value MATCHES "(?i)(union|select|insert|delete|drop|--|#|;)")