CVE-2025-2393
📋 TL;DR
This critical vulnerability in code-projects Online Class and Exam Scheduling System 1.0 allows remote attackers to execute SQL injection attacks via the 'id' parameter in the /pages/salut_del.php file. This can lead to unauthorized database access, data theft, or system compromise. All users running version 1.0 of this software are affected.
💻 Affected Systems
- code-projects Online Class and Exam Scheduling System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, system takeover, or ransomware deployment
Likely Case
Unauthorized data access, modification, or deletion of scheduling and user data
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Exploit details publicly available on GitHub; SQL injection via URL parameter manipulation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'id' parameter before processing
Modify /pages/salut_del.php to validate and sanitize input using prepared statements
Web Application Firewall Rules
allBlock SQL injection patterns targeting the vulnerable endpoint
Add WAF rule: deny requests to /pages/salut_del.php with SQL keywords in parameters
🧯 If You Can't Patch
- Restrict network access to the application using firewall rules
- Implement database-level controls with minimal required permissions
🔍 How to Verify
Check if Vulnerable:
Test /pages/salut_del.php?id=1' OR '1'='1 to see if SQL error occursCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test with SQL injection payloads; successful fix should return error or no data📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in application logs
- Unusual database queries from web server
Network Indicators:
- HTTP requests to /pages/salut_del.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/pages/salut_del.php" AND (param="id" AND value MATCHES "'.*OR.*|'.*AND.*|'.*SELECT.*")