SQLi in student/teacher signup causing account takeover and mass password reset (CVE-01)

Vulnerability Overview SQL injection vulnerabilities exist in and , allowing unauthenticated users to take over accounts. The vulnerability is exploited by inserting boolean payloads into the registration form inputs, causing the verification query to match any existing account and writing the attacker-chosen password to that account. Impact Scope Affected Version: commit Vulnerability Type: SQL Injection (Unauthenticated, Account Takeover/Arbitrary Password Overwrite) Impact: - Unauthenticated arbitrary takeover of any student or teacher account (including accounts created by administrators). - Write operations are not limited to a single row; for example, can reset the passwords for all rows in the table, leading to a Denial of Service. - Combined with plaintext password storage and login SQL injection (CVE-01), the entire authentication layer is compromised. Remediation Root Cause: Each form field is directly concatenated into the SQL string. Developers believed these fields were only used for matching, considering them safe. However, injected quotes break the literals, causing the verification query to match arbitrary rows. Fix Recommendations: - Use parameterized queries or prepared statements to prevent SQL injection. - Perform strict validation and filtering on user input. Proof of Concept (POC) Code Evidence CVSS Score CVSS v3.1 Base Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Calculation: exploitability = 8.22 x 0.85 x 0.77 x 0.85 x 0.85 = 3.89; impact = 6.42 x [1 - (1-0.56)^3] = 5.87; base = roundup(3.89 + 5.87) = 9.8 Justification: A single unauthenticated request can take over any student or teacher account, including mass password overwrites, compromising the availability of all accounts and granting the attacker access to victims' data and privileges.

Goal Reached Thanks to every supporter — we hit 100%!

SQLi in student/teacher signup causing account takeover and mass password reset (CVE-01)

More from this source