Loading story…
The AIS3 Final sqlpwn PHP challenge contained a registration/login race condition that allowed a newly created account to authenticate before its corresponding lock record took effect. Its note-title handling also escaped input before truncating it to 32 bytes, enabling a one-byte truncation flaw that could alter the resulting SQL query and support SQL injection. The application used legacy mysql_* functions and unsalted MD5 password hashes, while an unauthenticated mode=info route exposed phpinfo() data.
After obtaining credentials for the orange administrator account, an attacker could use the administrative boom parameter to perform local file inclusion. Including a PHP session file with attacker-influenced content enabled PHP code execution, turning the chained authentication and injection flaws into full application compromise. The source also rendered note titles without evident output encoding and exposed the flag endpoint to any authenticated user, further weakening access controls.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A GitHub Gist containing the PHP source for the AIS3 Final CTF Web challenge sqlpwn.php was created. The code included registration, login, note, administrator, phpinfo, and flag-handling functionality.
Review of the sqlpwn source showed that mode=info invokes phpinfo() without an explicit authentication check, and that note titles are rendered without visible HTML output encoding. These behaviors can expose environment details and potentially enable stored script injection.
A technical analysis identified a registration/login race condition, a truncation-based SQL injection for obtaining the orange user's password hash, and administrator local file inclusion. The chain uses a controlled PHP session file to achieve PHP code execution after obtaining administrator status.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MITRE has published two high-severity SQL injection vulnerabilities affecting widely available PHP-based management applications: **SourceCodester Payroll Management and Information System v1.0** and **CodeAstro Simple Attendance Management System v1.0**. The SourceCodester issue, tracked as `CVE-2026-37347`, affects `/payroll/view_employee.php` and is classified as `CWE-89`; its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` indicates remote exploitation with no privileges or user interaction required, with high impact to confidentiality and integrity. The CodeAstro flaw, `CVE-2026-37749`, is also a `CWE-89` SQL injection bug and affects `index.php`, where the `username` parameter can be abused by remote, unauthenticated attackers to bypass authentication. Its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` reflects high impact across confidentiality, integrity, and availability. Both CVE entries were updated with severity details and public references, including GitHub documentation, underscoring the exposure of internet-reachable administrative and employee-management functions to straightforward injection attacks.
Jun 29, 2026
Security researchers have detailed real-world exploitation techniques used to identify and leverage vulnerabilities in web applications, focusing on bug bounty scenarios. One researcher described successfully exploiting a path traversal vulnerability in a company's file upload functionality, allowing arbitrary file overwrites and folder creation by manipulating file save locations. Additional attempts were made to exploit content-type handling and CSV injection, though system command execution was not achieved in that case. Another researcher demonstrated the use of UNION-based SQL injection to enumerate database tables, extract credential columns, and ultimately dump usernames and passwords from a non-Oracle database. By exploiting a vulnerable product category filter, the attacker was able to gain administrator access, highlighting the risk of improperly sanitized user input in web applications. Both cases underscore the importance of secure coding practices and thorough application testing to prevent such vulnerabilities from being exploited in the wild.
Jun 29, 2026
Security researchers identified critical vulnerabilities in educational institution web applications, enabling unauthorized access to sensitive student data. In one case, a penetration tester discovered a SQL injection flaw in an educational website's receipt download endpoint, which allowed the attacker to enumerate university numbers, exploit the vulnerability using `sqlmap`, and ultimately dump the database containing personally identifiable information (PII) of students. Attempts to escalate the attack to an OS shell were unsuccessful due to insufficient permissions, but the exposure of student records highlights the severity of the flaw. Another incident involved a manual penetration test against a major university's web infrastructure, where the tester bypassed automated tools and used manual techniques to identify and exploit weaknesses in a subdomain's registration functionality. The attacker was able to register as a non-member, receive verification codes, and gain deeper access, demonstrating the risks posed by insufficient input validation and weak authentication mechanisms in academic environments. These incidents underscore the ongoing threat of SQL injection and the need for robust security controls in educational sector web applications.
Jul 12, 2026