📄 Description (English)
A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file admin/deletecourse.php of the component GET Request Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
🤖 AI Executive Summary
QueryMine SMS contains a critical SQL injection vulnerability in the admin/deletecourse.php file through the ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands. With a CVSS score of 7.3 and public exploit availability, this poses an immediate threat to organizations using QueryMine SMS for educational or administrative messaging. The vendor's unresponsiveness and lack of patch availability necessitate urgent compensating controls and potential product replacement evaluation.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 7, 2026 15:32
🇸🇦 Saudi Arabia Impact Assessment
Saudi educational institutions (Ministry of Education, universities, private schools) using QueryMine SMS for student communication and course management face critical risk of database compromise, unauthorized access to student records, and potential data exfiltration. Government agencies using SMS-based administrative systems could experience service disruption and data breach. Telecom operators (STC, Mobily, Zain) providing SMS gateway services may face cascading impacts if QueryMine is integrated into their platforms. Healthcare institutions using SMS for appointment notifications could have patient data exposed. The vulnerability allows complete database takeover without authentication, making it particularly dangerous in Saudi's regulated sectors subject to SAMA, NCA, and MOH compliance requirements.
🏢 Affected Saudi Sectors
Education (Ministry of Education, Universities, Private Schools)
Government (Administrative SMS systems)
Healthcare (Patient notification systems)
Telecommunications (STC, Mobily, Zain SMS gateways)
Banking (Customer communication systems)
Energy (ARAMCO internal communications)
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
8.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all QueryMine SMS instances in your environment and document their network exposure
2. Implement network-level access controls: restrict admin/deletecourse.php to authorized IP ranges only
3. Disable or remove QueryMine SMS if not critical; evaluate alternative SMS platforms
4. Review database access logs for suspicious SQL patterns and unauthorized queries
5. Implement Web Application Firewall (WAF) rules to block SQL injection patterns in ID parameter
COMPENSATING CONTROLS:
6. Apply input validation: whitelist numeric-only values for ID parameter at application level
7. Implement parameterized queries/prepared statements if source code access available
8. Enable database query logging and set up alerts for UNION-based and time-based SQL injection attempts
9. Restrict database user permissions: ensure QueryMine database account has minimal required privileges
10. Implement rate limiting on admin/deletecourse.php endpoint
DETECTION RULES:
- Monitor for GET requests to admin/deletecourse.php with ID parameters containing: quotes, semicolons, SQL keywords (UNION, SELECT, DROP, INSERT)
- Alert on database error messages in HTTP responses from this endpoint
- Track failed authentication attempts followed by SQL injection attempts
- Monitor for unusual database activity: schema enumeration, data exfiltration queries
LONG-TERM:
11. Migrate to actively maintained SMS platform with security updates
12. Conduct full database audit for unauthorized modifications or data access
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تحديد جميع مثيلات QueryMine SMS في بيئتك وتوثيق تعرضها للشبكة
2. تطبيق ضوابط الوصول على مستوى الشبكة: تقييد admin/deletecourse.php على نطاقات IP مصرح بها فقط
3. تعطيل أو إزالة QueryMine SMS إذا لم تكن حرجة؛ تقييم منصات SMS بديلة
4. مراجعة سجلات وصول قاعدة البيانات للأنماط المريبة والاستعلامات غير المصرح بها
5. تطبيق قواعد جدار حماية تطبيقات الويب (WAF) لحجب أنماط حقن SQL في معامل ID
الضوابط التعويضية:
6. تطبيق التحقق من الإدخال: قائمة بيضاء للقيم الرقمية فقط لمعامل ID على مستوى التطبيق
7. تطبيق الاستعلامات المعاملة/البيانات المحضرة إذا كان الوصول إلى الكود المصدري متاحاً
8. تفعيل تسجيل استعلامات قاعدة البيانات وإعداد تنبيهات لمحاولات حقن SQL القائمة على UNION والمستندة إلى الوقت
9. تقييد أذونات مستخدم قاعدة البيانات: تأكد من أن حساب QueryMine لديه الحد الأدنى من الامتيازات المطلوبة
10. تطبيق تحديد معدل على نقطة نهاية admin/deletecourse.php
قواعد الكشف:
- مراقبة طلبات GET إلى admin/deletecourse.php مع معاملات ID تحتوي على: علامات اقتباس، فواصل منقوطة، كلمات مفتاحية SQL
- تنبيه رسائل خطأ قاعدة البيانات في استجابات HTTP من هذه النقطة النهائية
- تتبع محاولات المصادقة الفاشلة متبوعة بمحاولات حقن SQL
- مراقبة نشاط قاعدة البيانات غير العادي: تعداد المخطط، استعلامات تسرب البيانات
المدى الطويل:
11. الهجرة إلى منصة SMS يتم صيانتها بنشاط مع تحديثات الأمان
12. إجراء تدقيق كامل لقاعدة البيانات للتعديلات غير المصرح بها أو الوصول إلى البيانات
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.14.2.1 - Secure development policy and procedures
ECC 2024 A.14.2.5 - Secure development environment
ECC 2024 A.12.6.1 - Management of technical vulnerabilities
ECC 2024 A.12.2.1 - Monitoring and logging of access to information
🔵 SAMA CSF
SAMA CSF 2.1 - Asset Management and Inventory
SAMA CSF 3.2 - Vulnerability Management
SAMA CSF 3.3 - Patch Management
SAMA CSF 4.1 - Access Control and Authentication
SAMA CSF 5.2 - Detection and Analysis
🟡 ISO 27001:2022
ISO 27001:2022 A.8.1 - User endpoint devices
ISO 27001:2022 A.8.3 - Access control
ISO 27001:2022 A.14.2 - Development security
ISO 27001:2022 A.12.6 - Management of technical vulnerabilities
ISO 27001:2022 A.12.4 - Logging
🟣 PCI DSS v4.0.1
PCI DSS 6.2 - Ensure security patches are installed
PCI DSS 6.5.1 - Injection flaws prevention
PCI DSS 10.2 - Implement automated audit trails
PCI DSS 11.2 - Vulnerability scanning