CVE-2023-48718
📋 TL;DR
Student Result Management System v1.0 contains unauthenticated SQL injection vulnerabilities in the 'class_name' parameter of add_students.php. Attackers can execute arbitrary SQL commands without authentication, potentially compromising the entire database. All users running this specific version are affected.
💻 Affected Systems
- Student Result Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution on the database server.
Likely Case
Database information disclosure, data manipulation, and potential privilege escalation within the application.
If Mitigated
Attack attempts are logged and blocked, with no successful exploitation due to proper input validation and parameterized queries.
🎯 Exploit Status
SQL injection is well-understood and automated tools exist for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://projectworlds.in/
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. If available, download and install the patched version. 3. Replace vulnerable add_students.php file with patched version.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept alphanumeric characters for class_name parameter
Modify add_students.php to include: if (!preg_match('/^[a-zA-Z0-9]+$/', $_POST['class_name'])) { die('Invalid input'); }
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system from sensitive networks
- Deploy intrusion detection/prevention systems to monitor for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test add_students.php endpoint with SQL injection payloads like: class_name=' OR '1'='1Check Version:
Check system documentation or about page for version informationVerify Fix Applied:
Test with same SQL injection payloads and verify they are rejected or properly escaped📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts after SQL injection
- Requests to add_students.php with special characters in parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in parameters
- Unusual traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="*add_students.php*" AND (param="*' OR*" OR param="*UNION SELECT*" OR param="*--*" OR param="*;--*")