Attack Chain

1. An attacker identifies a target host running code-projects Assessment Management 1.0.
2. The attacker crafts an HTTP request targeting the /welcome.php endpoint.
3. The attacker injects malicious SQL syntax into the 'userid' query parameter.
4. The web server passes the unsanitized 'userid' parameter to the database management system.
5. The database executes the injected malicious SQL statements with the privileges of the web application service account.
6. The attacker leverages the vulnerability to exfiltrate sensitive user records or administrative credentials from the backend database.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain unauthorized access to the application database. This can lead to the full compromise of user data, loss of confidentiality, integrity, and availability of the Assessment Management system. Given the public availability of exploit material, the likelihood of targeted or automated scanning attempts is high.

Recommendation

• Identify all instances of Assessment Management 1.0 within the environment and restrict network access to these assets until a vendor-supplied patch is applied.
• Monitor web application firewall logs for HTTP requests directed at /welcome.php containing SQL meta-characters (such as single quotes, semicolons, or SQL keywords like UNION, SELECT, SLEEP) in the 'userid' parameter.
• Deploy the provided Sigma rule to detect exploitation attempts targeting this vulnerability.
• Perform a database audit to detect unauthorized queries originating from the web application service account.