SQL Injection in CASAP Automated Enrollment System

Executive Summary

This vulnerability is a SQL Injection in the CASAP Automated Enrollment System 1.0. It occurs in the save_stud.php file where user-supplied input for parameters fname, lname, and student_class is not properly sanitized. This allows attackers to manipulate SQL queries, potentially accessing or modifying database contents.

Useful 0 Not Useful 0

Detection Guidance

To detect SQL Injection in CASAP Automated Enrollment System 1.0, inspect HTTP requests to save_stud.php for unsanitized fname, lname, or student_class parameters. Test with payloads like ' OR '1'='1 or admin'-- in input fields and monitor for database errors or unexpected responses.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data stored in the database, such as student records. Attackers might extract, alter, or delete data, leading to privacy breaches or system disruptions. It could also enable further attacks on the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data. Organizations may face legal penalties, fines, or reputational damage due to data breaches caused by this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the application to a patched version if available. If not, implement input validation for fname, lname, and student_class parameters in save_stud.php. Use prepared statements with parameterized queries to prevent SQL Injection.

Useful 0 Not Useful 0