A critical vulnerability (CVE-2022-2680) has been discovered in the SourceCodester Church Management System version 1., affecting an unknown function in the /login.php file. This weakness allows an attacker to perform SQL injection attacks, potentially exposing sensitive information and gaining unauthorized access. The exploit details have been publicly disclosed and may be used by malicious actors. The vulnerability has been assigned the identifier VDB-205668 in the vulnerability database.

Detailed Exploit Description

The affected function within the /login.php file can be manipulated through the username argument. Utilizing the following payload can result in a successful SQL injection attack:

' OR (SELECT 7064 FROM(SELECT COUNT(*),CONCAT(x71627a7671,(SELECT (ELT(7064=7064,1))),x716b707871,FLOOR(RAND()*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- jURL

The above payload can be sent as part of a malicious request targeting the username field, allowing the attacker to bypass authentication and access the vulnerable application's database. The attack can be launched remotely and will provide information from the INFORMATION_SCHEMA.PLUGINS table.

Original References

The vulnerability was initially reported to the public through a disclosure by an external researcher. Original sources and relevant information can be accessed through the following links:

- Official Vulnerability Disclosure _(Replace with the actual URL)_
- NVD - National Vulnerability Database
- Vulnerability Database Entry - VDB-205668 _(Replace with the actual URL)_

Recommendations

To mitigate this vulnerability, it is advised to immediately apply any available security updates, patches, or workarounds provided by the software vendor. As a best practice, input validation should be implemented wherever possible to reduce the risk of SQL injection vulnerabilities. Ensure that regular vulnerability scans and security assessments are conducted to identify and rectify any weaknesses in the infrastructure and applications.

Users are encouraged to monitor the official SourceCodester website for updates and announcements to stay informed about any security advisories related to this vulnerability.

Timeline

Published on: 08/05/2022 21:15:00 UTC
Last modified on: 08/10/2022 19:33:00 UTC