Attack Chain

1. An attacker identifies a vulnerable QueryMine SMS instance running a version up to 7ab5a9ea196209611134525ffc18de25c57d9593.
2. The attacker crafts a malicious HTTP GET request targeting the admin/deletecourse.php file.
3. The crafted request includes a manipulated ID parameter containing SQL injection payloads.
4. The web server processes the request and passes the malicious ID parameter to the vulnerable SQL query without proper sanitization.
5. The injected SQL code is executed against the database, potentially allowing the attacker to bypass authentication and access sensitive data.
6. The attacker may extract user credentials, course data, or other confidential information.
7. The attacker could modify or delete data within the database.
8. The attacker could potentially use the SQL injection to gain further access to the server or escalate privileges.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive student and administrative data, modification or deletion of critical course information, and potential compromise of the entire QueryMine SMS system. Given that publicly available exploit code exists, the risk of widespread exploitation is elevated. The lack of specific versioning information makes identifying vulnerable installations challenging. If successful, this could allow an attacker to use the database server as an entry point into the network.

Recommendation

• Inspect web server access logs for suspicious GET requests to admin/deletecourse.php containing unusual characters or SQL keywords in the ID parameter; deploy the provided Sigma rule to detect this activity.
• Implement input validation and sanitization measures for the ID parameter in admin/deletecourse.php to mitigate SQL injection vulnerabilities.
• Monitor web server logs for SQL errors originating from the admin/deletecourse.php script, which could indicate attempted exploitation.
• Since patching information is unavailable, consider web application firewall (WAF) rules to filter out malicious SQL injection attempts targeting the ID parameter.