CVE-2025-8166
📋 TL;DR
A critical SQL injection vulnerability exists in the Church Donation System 1.0, specifically in the admin login page. Attackers can manipulate the Username parameter in POST requests to execute arbitrary SQL commands, potentially compromising the database. This affects all installations of Church Donation System 1.0 that are exposed to network access.
💻 Affected Systems
- Church Donation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive donation data, user information, and administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts would still be logged.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb. The attack requires no authentication and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
Input Validation Filter
allAdd input validation to sanitize the Username parameter before processing.
Modify /admin/index.php to add: $username = mysqli_real_escape_string($connection, $_POST['Username']);
🧯 If You Can't Patch
- Isolate the system on a private network with no internet access.
- Implement strict network ACLs to allow only trusted IP addresses to access the admin interface.
🔍 How to Verify
Check if Vulnerable:
Test the /admin/index.php endpoint with SQL injection payloads in the Username parameter (e.g., admin' OR '1'='1).Check Version:
Check the software version in the application interface or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that input validation is properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL-like patterns in Username field
Network Indicators:
- HTTP POST requests to /admin/index.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri_path="/admin/index.php" AND (request_body CONTAINS "' OR" OR request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT")