SQL Injection in SourceCodester Online Faculty Clearance System

The SourceCodester Online Faculty Clearance System version 1.0 contains a SQL injection vulnerability within the /delete_requirement.php script. The vulnerability exists due to insufficient sanitization of the ID argument passed during HTTP requests to this endpoint. A remote, unauthenticated attacker can exploit this flaw to inject malicious SQL commands, which are executed directly against the application database. This can lead to unauthorized data retrieval, modification, or potential administrative control over the underlying database. The vulnerability has been confirmed with public exploit availability, increasing the risk of exploitation by opportunistic actors targeting known vulnerabilities in small, publicly available web applications. Defenders should prioritize auditing web server logs for suspicious requests to this specific endpoint and ensure all inputs are properly validated at the application layer.

Impact

Successful exploitation allows a remote attacker to perform unauthorized database operations, potentially resulting in the compromise of faculty clearance records and personal information stored within the application. Given the nature of SQL injection, this could result in complete data exfiltration, unauthorized deletion of records, or the modification of authentication data.

Recommendation

1. Deploy web application firewall (WAF) rules to inspect and filter input for SQL syntax characters within the ID parameter of requests to /delete_requirement.php.
2. Implement strict input validation and parameterized queries in the affected PHP source code to neutralize SQL injection vectors.
3. Review web server access logs for anomalous behavior targeting the /delete_requirement.php endpoint, specifically looking for attempts to inject SQL keywords or special characters.