CVE-2023-45342
📋 TL;DR
Online Food Ordering System v1.0 has unauthenticated SQL injection vulnerabilities in the phone parameter of the registration router. Attackers can execute arbitrary SQL commands without authentication, potentially compromising the entire database. All deployments of this specific version are affected.
💻 Affected Systems
- Online Food Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure, credential theft, and potential privilege escalation to administrative access.
If Mitigated
Limited impact with proper input validation and database permissions, though injection attempts would still be logged.
🎯 Exploit Status
SQL injection via phone parameter in routers/register-router.php requires no authentication and uses simple payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://projectworlds.in/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If available, backup database and files. 3. Replace vulnerable files with patched version. 4. Test functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept numeric characters in phone parameter
Modify routers/register-router.php to validate phone parameter with preg_match('/^[0-9]+$/', $_POST['phone'])
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords like UNION, SELECT, INSERT, UPDATE, DELETE, DROP in phone parameter
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the application code
- Restrict database user permissions to minimum required and implement network segmentation
🔍 How to Verify
Check if Vulnerable:
Send POST request to routers/register-router.php with phone parameter containing SQL injection payload like ' OR '1'='1Check Version:
Check version in application files or database configurationVerify Fix Applied:
Test with same payloads and verify they are rejected or properly escaped📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed registration attempts with special characters in phone field
- Database queries with unexpected UNION or SELECT statements
Network Indicators:
- HTTP POST requests to register-router.php containing SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/routers/register-router.php" AND (phone="*UNION*" OR phone="*SELECT*" OR phone="*OR*1=1*")