itsourcecode College Management System SQL Injection Vulnerability in Results Management Component

A SQL injection vulnerability exists in the itsourcecode College Management System version 1.0. The issue is located in the '/admin/add-single-student-results.php' file, within the Parameter Handler component. The vulnerability arises because the application does not properly sanitize or validate the 'course_code' parameter, allowing attackers to inject malicious SQL code. This exploitation can be performed remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate database queries. This could lead to unauthorized database access, leakage or tampering of sensitive data, and in some cases, could allow for broader system control or cause service interruptions.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the '/admin/add-single-student-results.php' page. Once there, send a POST request with the 'course_code' parameter. The injection can be tested using payloads that exploit time-based blind SQL injection, such as ones that use the 'SLEEP' function, or by using UNION-based injection techniques that extract database information.

Remediation

It is recommended to use prepared statements and parameter binding to prevent SQL injection. Input validation and filtering should be implemented to ensure user input conforms to expected formats. Additionally, minimize database user permissions and conduct regular security audits.