CVE-2025-3174
📋 TL;DR
This critical SQL injection vulnerability in Project Worlds Online Lawyer Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'experience' parameter in /searchLawyer.php. Attackers can potentially access, modify, or delete database content. All users running version 1.0 are affected.
💻 Affected Systems
- Project Worlds Online Lawyer Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, extraction of sensitive lawyer/client information, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and WAF protection in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection via GET parameter requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to a different system or implementing custom fixes.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the 'experience' parameter in /searchLawyer.php
Modify searchLawyer.php to validate 'experience' parameter as integer or implement allowlist
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection attempts
Add WAF rule: deny requests containing SQL keywords in 'experience' parameter
🧯 If You Can't Patch
- Remove or restrict access to /searchLawyer.php file
- Implement network segmentation and isolate the vulnerable system
🔍 How to Verify
Check if Vulnerable:
Test /searchLawyer.php?experience=1' OR '1'='1 and observe if SQL error or unexpected behavior occursCheck Version:
Check system documentation or configuration files for version informationVerify Fix Applied:
Test with SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /searchLawyer.php with SQL keywords in parameters
- Database error logs showing SQL syntax errors
Network Indicators:
- Unusual SQL keywords in HTTP GET parameters
- High volume of requests to vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/searchLawyer.php" AND (param="experience" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|or|and|'|--|#)")