CVE-2024-43774
📋 TL;DR
This SQL injection vulnerability in Easytest Online Test Platform allows authenticated attackers to execute arbitrary SQL commands via the uid parameter in the download personal learning course function. Attackers could potentially read, modify, or delete database content, affecting all users of version 24E01 and earlier.
💻 Affected Systems
- Easytest Online Test Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, privilege escalation to admin, and potential remote code execution via database functions.
Likely Case
Data theft of user information, test results, and potentially authentication credentials stored in the database.
If Mitigated
Limited to authenticated user data access if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
SQL injection via uid parameter requires authenticated access but is straightforward to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Contact vendor for patched version. 2. If patch available, download and install. 3. Test functionality after update.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to restrict uid parameter to expected format
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns in uid parameter
🧯 If You Can't Patch
- Disable the download personal learning course function entirely
- Implement strict input validation and parameterized queries for the uid parameter
🔍 How to Verify
Check if Vulnerable:
Test uid parameter with SQL injection payloads like ' OR '1'='1 in authenticated sessionCheck Version:
Check platform version in admin panel or configuration filesVerify Fix Applied:
Verify parameterized queries are used and test with SQL injection payloads that should be rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed download attempts with malformed uid parameters
- UID parameter containing SQL keywords
Network Indicators:
- HTTP requests to download function with SQL injection patterns in parameters
SIEM Query:
source="web_logs" AND (uri="*download*" OR uri="*personal*learning*") AND (param="*uid=*OR*" OR param="*uid=*UNION*" OR param="*uid=*SELECT*")