SQL Injection in code-projects Assessment Management 1.0

A critical SQL injection vulnerability has been identified in the Assessment Management 1.0 software, a product developed by code-projects. The vulnerability resides in the /welcome.php file, which fails to properly sanitize the 'userid' parameter before incorporating it into backend database queries. This flaw allows remote, unauthenticated attackers to perform SQL injection attacks, potentially resulting in unauthorized data exfiltration, modification, or deletion from the application database. Publicly available exploit code currently exists for this vulnerability, increasing the risk of active exploitation. Security teams should prioritize patching or restricting access to this application, as the entry point is exposed via standard web request parameters.

Attack Chain

1. An attacker identifies a target host running code-projects Assessment Management 1.0.
2. The attacker crafts an HTTP request targeting the /welcome.php endpoint.
3. The attacker injects malicious SQL syntax into the 'userid' query parameter.
4. The web server passes the unsanitized 'userid' parameter to the database management system.
5. The database executes the injected malicious SQL statements with the privileges of the web application service account.
6. The attacker leverages the vulnerability to exfiltrate sensitive user records or administrative credentials from the backend database.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain unauthorized access to the application database. This can lead to the full compromise of user data, loss of confidentiality, integrity, and availability of the Assessment Management system. Given the public availability of exploit material, the likelihood of targeted or automated scanning attempts is high.

Recommendation

• Identify all instances of Assessment Management 1.0 within the environment and restrict network access to these assets until a vendor-supplied patch is applied.
• Monitor web application firewall logs for HTTP requests directed at /welcome.php containing SQL meta-characters (such as single quotes, semicolons, or SQL keywords like UNION, SELECT, SLEEP) in the 'userid' parameter.
• Deploy the provided Sigma rule to detect exploitation attempts targeting this vulnerability.
• Perform a database audit to detect unauthorized queries originating from the web application service account.