SUV2 | Universidad Nacional de Trujillo

Disclaimer

This article is provided for educational and informational purposes only. Its goal is to raise awareness and understanding of potential security issues in Universidad Nacional de Trujillo’s SUV system and to encourage the adoption of adequate security measures. Using this information for malicious or illegal activity is neither encouraged nor endorsed. The author takes no responsibility for improper use of the information provided, nor for any damage arising from it.

Background

The system Universidad Nacional de Trujillo (UNT) currently uses to manage its students is SUV Curriculum >= 2018, a web system built on PHP 5.6.31 with PostgreSQL as its DBMS. (Universidad Nacional de Trujillo)

The system lets students do things like check their grades or enroll in courses. It has no reliable, secure authentication appropriate to the current context [and it genuinely warrants one], so any unauthorized person can reach any student’s information — personal data included.

SUPPORT

Support for PHP 5.6.31 ended on December 31, 2018.

Vulnerabilities

SQL Injection

SQL Injection is a security vulnerability that lets an attacker inject SQL code into a web application. The attacker can use it to obtain sensitive information from the database, modify data, or even run operating system commands.

In SUV2’s case, a single sqlmap command in Python is enough to index every database and its tables.

As an example, the enrollment database is shown below.

Database: matriculas
[28 tables]
+----------------------------------------------+
| alumno                                       |
| aula_virtual                                 |
| backup_notas                                 |
| convalidacion                                |
| crono_matricula                              |
| curricula                                    |
| curricula_creditos                           |
| curricula_curso                              |
| curso                                        |
| equivalencia                                 |
| exoneracion                                  |
| matricula                                    |
| matricula_detalle                            |
| matricula_detalle_temp                       |
| orden_pago                                   |
| orden_pago_detalle                           |
| pesos                                        |
| pesos_alumno                                 |
| pesos_fecha                                  |
| prerequisitos                                |
| prerequisitos_creditos                       |
| registro_matricula_interna                   |
| registro_matricula_resolucion                |
| resolucion                                   |
| sanciones                                    |
| servicio_pagos                               |
| tipo_resolucion                              |
| voucher                                      |
+----------------------------------------------+

Cross Site Request Forgery

We found a CSRF (Cross Site Request Forgery) vulnerability in the system. It lets an attacker perform actions on behalf of a user authenticated on site A from site B.

In SUV2’s case, privileged student information is reachable while holding the credentials of a single student. Operations such as uploading schedules or editing groups are possible too.

The cause is a security token that is never verified on the server, so anyone can perform operations on behalf of an authenticated user.

COOKIES

Both sites share the same PHPSESSID, so an authenticated user’s session on site A is reachable from site B.

Sensitive data exposure

Student profile photos (university ID card)

One thing the existing vulnerabilities make possible is extracting the student profile photos held on the university ID card. This can lead to misuse of students’ identity, which underlines how urgently the system’s security needs to improve.

Personal Data Protection Act Under Personal Data Protection Act No. 29733,

• Article 9. Security principle: it states that the owner of the personal data bank and whoever processes it must adopt the technical, organizational and legal measures needed to guarantee the security of personal data.

Recommendations

For those responsible for the SUV system, the following recommendations are essential to mitigate the present vulnerabilities and protect the privacy and security of student information:

1. Update the system and the technologies it uses: the system currently runs on PHP 5.6.31, whose support ended in December 2018. Moving to a newer, secure version of PHP — or considering another language or framework with stronger security guarantees — is essential.

2. Improve authentication: a more robust and secure authentication system is needed, one that blocks unauthorized access to student information.

3. Protect against SQL injection: security measures such as parameterized queries or an ORM (Object-Relational Mapping) should be put in place.

4. Protect against CSRF: implement measures such as verifying security tokens on the server.

5. Encrypt sensitive information: sensitive data such as student profile photos should be encrypted to prevent extraction and misuse.

These measures can go a long way toward improving the system’s security and protecting student information.