CVE-2025-3170
📋 TL;DR
A critical SQL injection vulnerability in Project Worlds Online Lawyer Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the block_id/unblock_id parameters in /admin_user.php. This affects all deployments of version 1.0, potentially enabling data theft, modification, or system compromise.
💻 Affected Systems
- Project Worlds Online Lawyer Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or remote code execution via database functions.
Likely Case
Unauthorized data access, modification of legal records, or administrative account takeover.
If Mitigated
Limited impact if proper input validation and WAF rules are in place, though SQL injection attempts may still be logged.
🎯 Exploit Status
Exploit requires access to admin_user.php endpoint. Public GitHub issues demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to block_id/unblock_id parameters to allow only numeric values
Modify /admin_user.php to add: if(!is_numeric($_GET['block_id'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting admin_user.php
Add WAF rule: Detect and block requests containing SQL keywords in block_id/unblock_id parameters
🧯 If You Can't Patch
- Restrict access to /admin_user.php using IP whitelisting or authentication requirements
- Implement database user with minimal privileges (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test by sending SQL injection payloads to /admin_user.php?block_id=1' OR '1'='1Check Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Verify that SQL injection attempts return error messages or are blocked without executing📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests to /admin_user.php with special characters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in block_id/unblock_id parameters
SIEM Query:
source="web_logs" AND uri="/admin_user.php" AND (block_id="*'*" OR unblock_id="*'*")