halex CourseSEL SQL Injection Vulnerability in IndexController

A SQL injection vulnerability has been identified in halex CourseSEL versions through 1.1.0. The issue arises in the 'check_sel' function of the 'Apps/Index/Controller/IndexController.class.php' file, where the 'seid' parameter is improperly sanitized before being included in an SQL query. This vulnerability allows authenticated attackers with low privileges to exploit the application by injecting malicious SQL payloads, potentially leading to unauthorized data access or manipulation.

Impact

Exploitation of this vulnerability allows authenticated users to bypass authorization and execute arbitrary SQL commands, which could be used to extract sensitive information from the database, such as administrative credentials, and gain full control over the application.

Reproduction

The vulnerability can be reproduced by sending a crafted HTTP GET request to the 'check_sel' endpoint with a valid 'seid' parameter. This request must include an authenticated session cookie. The SQL injection can be automated using a tool like sqlmap, which can exploit the vulnerability and extract database information.