SQL Injection in SourceCodester College Notes Gallery Management System

SourceCodester College Notes Gallery Management System version 1.0 contains a critical SQL injection vulnerability in the login.php file. The application fails to properly sanitize the 'User' argument passed to the authentication endpoint. An unauthenticated remote attacker can exploit this flaw by submitting crafted input through the login form, allowing them to manipulate back-end database queries. This vulnerability is publicly disclosed, increasing the risk of exploitation by automated scanners and opportunistic threat actors. Successful exploitation can lead to unauthorized access, data exfiltration, or modification of the application database. Organizations using this software should restrict access to the login portal and prioritize remediation.

Attack Chain

1. Attacker identifies the target login page hosted at /College/login.php.
2. Attacker probes the 'User' POST parameter for SQL injection vectors.
3. Attacker submits a crafted payload containing SQL special characters or logic-altering commands (e.g., OR 1=1).
4. The back-end database executes the injected command as part of the authentication check.
5. The application returns database information, bypasses authentication, or allows data manipulation.
6. Attacker gains unauthorized administrative access to the management system.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass authentication, potentially exposing sensitive college administrative data or gallery content. The impact includes full compromise of the application's database, leading to potential data loss or unauthorized administrative access to the platform.

Recommendation

1. Restrict access to the /College/login.php endpoint to authorized IP ranges or implement WAF rules to detect and block SQL injection patterns.
2. Implement parameterized queries for all database interactions involving user-supplied input in the College Notes Gallery Management System.
3. Deploy the Sigma rules below to monitor for suspicious POST requests to the authentication endpoint containing SQL control characters.
4. Perform an audit of application database logs to identify signs of unauthorized access or unexpected error patterns.