QueryMine SMS SQL Injection Vulnerability in editcourse.php

A SQL injection vulnerability has been identified in QueryMine SMS versions prior to 7ab5a9ea196209611134525ffc18de25c57d9593. The issue arises in the admin/editcourse.php file within the GET Request Parameter Handler component. The vulnerability allows remote attackers to manipulate the 'id' parameter, leading to arbitrary SQL execution. This could result in unauthorized data access, modification, deletion, or in severe cases, server control.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can execute arbitrary SQL commands. This could lead to unauthorized access to database information, such as user credentials and course data, manipulation or deletion of database records, and potentially gaining control over the server.

Reproduction

To reproduce this vulnerability, send a GET request to the admin/editcourse.php page with a crafted 'id' parameter that includes SQL injection payloads. The injection can be verified by observing the application's response, which may indicate successful execution of the injected SQL code.