Online Examination System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Summary

Name	Online Examination System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Code name	Pires
Product	Online Examination System
Vendor	Projectworlds Pvt. Limited
Affected versions	Version 1.0
State	Public
Release date	2023-11-01

Vulnerabilities

Kind	Unauthenticated SQL Injections (SQLi)
Rule	146. SQL Injection
Remote	Yes
CVSSv3 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSSv3 Base Score	9.8
Exploit available	Yes
CVE ID(s)	CVE-2023-45111

Description

Online Examination System v1.0 is vulnerable to an Unauthenticated SQL Injection vulnerability. The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. The vulnerable code is:

$ref=@$_GET['q'];
$name = $_POST['name'];
$email = $_POST['email'];
$subject = $_POST['subject'];
...
$feedback = $_POST['feedback'];
$q=mysqli_query($con,"INSERT INTO feedback VALUES  ('$id' , '$name', '$email' , '$subject', '$feedback' , '$date' , '$time')")or die ("Error");

Our security policy

We have reserved the ID CVE-2023-45111 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Version: Online Examination System v1.0
• Operating System: Any

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team.

References

Vendor page https://projectworlds.in/

Timeline