Attack Chain

1. Attacker identifies the target login page hosted at /College/login.php.
2. Attacker probes the 'User' POST parameter for SQL injection vectors.
3. Attacker submits a crafted payload containing SQL special characters or logic-altering commands (e.g., OR 1=1).
4. The back-end database executes the injected command as part of the authentication check.
5. The application returns database information, bypasses authentication, or allows data manipulation.
6. Attacker gains unauthorized administrative access to the management system.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass authentication, potentially exposing sensitive college administrative data or gallery content. The impact includes full compromise of the application's database, leading to potential data loss or unauthorized administrative access to the platform.

Recommendation

1. Restrict access to the /College/login.php endpoint to authorized IP ranges or implement WAF rules to detect and block SQL injection patterns.
2. Implement parameterized queries for all database interactions involving user-supplied input in the College Notes Gallery Management System.
3. Deploy the Sigma rules below to monitor for suspicious POST requests to the authentication endpoint containing SQL control characters.
4. Perform an audit of application database logs to identify signs of unauthorized access or unexpected error patterns.