CVE-2025-4706
📋 TL;DR
This critical SQL injection vulnerability in Projectworlds Online Examination System 1.0 allows attackers to manipulate database queries through the Visit_year parameter in /Procedure3b_yearwiseVisit.php. Remote attackers can potentially read, modify, or delete database contents, including sensitive examination data. All systems running the vulnerable version are affected.
💻 Affected Systems
- Projectworlds Online Examination System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution via database functions.
Likely Case
Data exfiltration of sensitive examination records, student information, and administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable. SQL injection is a well-understood attack vector with many automated tools available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. If no patch available, implement workarounds
3. Consider migrating to alternative software
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure Visit_year parameter contains only expected values
Add PHP validation: if(!preg_match('/^\d{4}$/', $_GET['Visit_year'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting the vulnerable endpoint
WAF rule: Block requests containing SQL keywords in Visit_year parameter
🧯 If You Can't Patch
- Restrict access to /Procedure3b_yearwiseVisit.php via .htaccess or web server configuration
- Implement network segmentation and place the system behind a reverse proxy with security controls
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /Procedure3b_yearwiseVisit.php?Visit_year=2024' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payloads and verify proper error handling or rejection occurs📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /Procedure3b_yearwiseVisit.php with SQL keywords in parameters
- Database error messages in web server logs
Network Indicators:
- Unusual database queries originating from web server
- Large data transfers from database to external IPs
SIEM Query:
source="web_server" AND uri="/Procedure3b_yearwiseVisit.php" AND (param="Visit_year" AND value MATCHES "'.*OR.*|'.*UNION.*|'.*SELECT.*")