Attack Chain

1. Attacker performs reconnaissance on the target application to identify the 'doedit.php' endpoint.
2. Attacker crafts a malicious HTTP POST request targeting the 'doedit.php' script.
3. Attacker injects SQL payloads into one or more of the parameters: id, name, title, year, gender, fromdate, todate, or people.
4. The vulnerable 'doedit.php' script receives the POST parameters without sufficient validation.
5. The application passes the unsanitized input directly into a 'mysqli_query' database function.
6. The backend database executes the injected SQL commands, allowing the attacker to bypass authentication or extract sensitive records.
7. Attacker successfully exfiltrates database contents or modifies application records to achieve unauthorized impact.

Impact

Successful exploitation allows a remote, unauthenticated attacker to manipulate database queries, potentially leading to the exposure of sensitive user registration data, unauthorized modifications to event records, or full compromise of the application backend. As of the time of reporting, the vendor has not provided a patch for this vulnerability.

Recommendation

• Implement input validation and sanitization for all parameters processed by 'doedit.php' to prevent SQL injection.
• Transition from raw 'mysqli_query' calls to parameterized queries (prepared statements) within the Registration-Edit Handler component.
• Monitor web application logs for HTTP POST requests to 'doedit.php' containing suspicious SQL keywords such as 'UNION', 'SELECT', 'OR 1=1', and comment delimiters (--) or (/*).
• Restrict access to the 'doedit.php' endpoint at the web application firewall or reverse proxy level until a formal security update is available from the project maintainers.
• Deploy detection rules to identify potential SQL injection attempts directed at the identified parameters within web server access logs.