CVE-2023-45115 : What You Need to Know

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'ch' parameter of the /update.php?q=addqns resource does not validate the characters received and they are sent unfiltered to the database.

Understanding CVE-2023-45115

Online Examination System v1.0 has multiple authenticated SQL injection vulnerabilities that could be exploited by attackers for malicious activities.

What is CVE-2023-45115?

CVE-2023-45115 refers to the vulnerability found in Online Examination System v1.0 that allows for multiple authenticated SQL injection attacks. This type of vulnerability could lead to unauthorized access to the database and potential data leakage.

The Impact of CVE-2023-45115

The impact of CVE-2023-45115 is critical, with a CVSS base score of 9.8. Attackers can exploit these SQL injection vulnerabilities to execute arbitrary SQL queries, potentially gaining access to sensitive data, altering data, or even deleting data within the system.

Technical Details of CVE-2023-45115

Vulnerability Description

The vulnerability lies in the 'ch' parameter of the /update.php?q=addqns resource, where input characters are not properly validated, allowing attackers to execute malicious SQL commands.

Affected Systems and Versions

Product: Online Examination System
Vendor: Projectworlds Pvt. Limited
Version: 1.0 (Affected)

Exploitation Mechanism

Attackers can exploit this vulnerability by manipulating the 'ch' parameter with crafted SQL queries, thereby gaining unauthorized access to the database.

Mitigation and Prevention

Immediate Steps to Take

Disable or restrict access to the vulnerable resource
Apply web application firewalls (WAFs) to filter and monitor incoming traffic
Regularly monitor and audit database activities for any suspicious behavior

Long-Term Security Practices

Implement input validation mechanisms to sanitize user inputs
Conduct regular security assessments and penetration testing
Educate developers on secure coding practices and the risks of SQL injection vulnerabilities

Patching and Updates

Projectworlds Pvt. Limited should release a patch or update that addresses the SQL injection vulnerabilities in Online Examination System v1.0 to ensure the security of the application.