CVE-2024-42843
📋 TL;DR
CVE-2024-42843 is a critical SQL injection vulnerability in Projectworlds Online Examination System v1.0 that allows attackers to execute arbitrary SQL commands via the subject parameter in feed.php. This affects all users running the vulnerable version of this web application, potentially exposing sensitive examination data and system information.
💻 Affected Systems
- Projectworlds Online Examination System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, authentication bypass, remote code execution, and full system takeover.
Likely Case
Unauthorized access to examination data, student records, and administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Simple SQL injection via GET/POST parameter with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries and input validation in feed.php.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns in subject parameter
# Example ModSecurity rule: SecRule ARGS:subject "@detectSQLi" "id:1001,phase:2,deny,status:403"
Input Validation Filter
allAdd PHP input validation to sanitize subject parameter before database query
<?php
$subject = filter_var($_GET['subject'], FILTER_SANITIZE_STRING);
// Use prepared statements with PDO or mysqli
?>
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from web server
🔍 How to Verify
Check if Vulnerable:
Test feed.php with SQL injection payload: feed.php?subject=1' OR '1'='1Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Verify parameterized queries are implemented and test with SQL injection payloads📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in PHP/application logs
- Unusual database queries from web server IP
- Multiple failed login attempts following SQL injection patterns
Network Indicators:
- HTTP requests to feed.php with SQL keywords in parameters
- Abnormal database traffic patterns from web application
SIEM Query:
source="web_logs" AND uri="*feed.php*" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR '1'='1*")