CVE-2025-3118
📋 TL;DR
CVE-2025-3118 is a critical SQL injection vulnerability in SourceCodester Online Tutor Portal 1.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in /tutor/courses/view_course.php. This affects all deployments of the vulnerable software version, potentially enabling data theft, modification, or system compromise.
💻 Affected Systems
- SourceCodester Online Tutor Portal
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or remote code execution if database functions allow it.
Likely Case
Unauthorized access to sensitive student/tutor data, grade manipulation, or account takeover.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public exploit code available on GitHub. Simple SQL injection requiring minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allModify /tutor/courses/view_course.php to use prepared statements with parameterized queries instead of concatenating user input.
Replace vulnerable SQL queries with PDO or mysqli prepared statements
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns targeting the ID parameter.
Add WAF rule: Block requests containing SQL keywords in ID parameter
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test by sending a crafted ID parameter with SQL injection payload to /tutor/courses/view_course.php and observing database errors or unexpected behavior.Check Version:
Check application version in admin panel or source code commentsVerify Fix Applied:
Attempt the same SQL injection test after implementing fixes; successful fix should return proper error handling without database exposure.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple rapid requests to view_course.php with varying ID parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in URL parameters
SIEM Query:
source="web_logs" AND url="/tutor/courses/view_course.php" AND (param="ID" AND value MATCHES "(?i)(union|select|insert|delete|drop|--|#)")