CVE-2025-0299
📋 TL;DR
A critical SQL injection vulnerability in code-projects Online Book Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the 's' parameter in /search_result.php. This affects all installations of version 1.0 that expose the vulnerable endpoint. Attackers can potentially access, modify, or delete database content without authentication.
💻 Affected Systems
- code-projects Online Book Shop
📦 What is this software?
Online Book Shop by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or full system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive data (user credentials, payment information, personal data) and potential data manipulation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Public exploit code is available in the GitHub gist reference. SQL injection via GET parameter manipulation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for the 's' parameter in search_result.php
Modify search_result.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM books WHERE title LIKE ?'); $stmt->bind_param('s', $search_term);
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns in the search parameter
Add WAF rule: Detect and block requests containing SQL keywords (UNION, SELECT, INSERT, etc.) in the 's' parameter
🧯 If You Can't Patch
- Restrict access to /search_result.php using IP whitelisting or authentication
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test by sending a SQL injection payload to the 's' parameter: http://target/search_result.php?s=' OR '1'='1Check Version:
Check the software version in admin panel or by examining source code filesVerify Fix Applied:
Test with the same payload and verify no SQL errors or unexpected data is returned📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple rapid requests to /search_result.php with suspicious parameters
- Requests containing SQL keywords (UNION, SELECT, DROP, etc.)
Network Indicators:
- Unusual database connection patterns from web server
- Large volume of data being transferred from database
SIEM Query:
source="web_logs" AND uri="/search_result.php" AND (query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*INSERT*")