Attack Chain

1. Attacker performs reconnaissance to identify instances of code-projects Task Management System 1.0.
2. Attacker navigates to the login page hosted by the vulnerable application.
3. Attacker crafts a malicious payload containing SQL injection sequences (e.g., ' OR 1=1 --).
4. Attacker submits the malicious payload via the email parameter in the login form POST request.
5. The server-side code in /index.php processes the unsanitized input within the Operation::select_with_multiple_condition function.
6. The injection triggers the execution of arbitrary SQL commands against the application's backend database.
7. Attacker achieves unauthorized data access, modification, or potentially full database compromise.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands. This can lead to the unauthorized disclosure of sensitive information, data manipulation, or denial of service of the backend database. Given the nature of the application as a Task Management System, exposed databases likely contain project details, user credentials, and internal communications, posing a significant risk to organizational confidentiality and integrity.

Recommendation

Prioritized actions for security teams:

• Identify and inventory all instances of code-projects Task Management System 1.0 within the environment.
• Implement a web application firewall (WAF) rule to inspect and block HTTP POST requests containing SQL injection patterns in the email parameter of the login form.
• Deploy the provided Sigma rule to detect attempts to reach the vulnerable endpoint with suspicious query parameters.
• Patch the application immediately or restrict access to the application to trusted networks if a patch is not available.