You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There are no requirements for authentication to perform this attack.
Problem
Authentication Bypass via SQL Injection
Root Cause
A SQL injection vulnerability was found in the '/admin/index.php' file and the '/index.php file' of the 'Online Blood Bank Management System' project. The reason for this issue is that attackers inject malicious code from the parameter "user" and use it directly in SQL queries without the need for appropriate cleaning or validation. This allows attackers to forge input values, thereby manipulating SQL queries and performing unauthorized operations, allowing access to both the user console page as well as the admin user page.
Impact
Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, unauthorized administrative functions, sensitive data leakage, data tampering, comprehensive system control, and even service interruption, posing a serious threat to system security and business continuity.
Description
In Version 1.0 of the Online Blood Bank Management System application, a SQL injection vulnerability was found in the '/admin/index.php' file and the '/index.php file' of the 'Online Blood Bank Management System' project. The reason for this issue is that attackers inject malicious code from the parameter "user" and use it directly in SQL queries without the need for appropriate cleaning or validation. This allows attackers to forge input values, thereby manipulating SQL queries and performing unauthorized operations, allowing access to both the user console page as well as the admin user page.
No login or authorization is required to exploit this vulnerability
Use prepared statements and parameter binding:
Preparing statements can prevent SQL injection as they separate SQL code from user input data. When using prepare statements, the value entered by the user is treated as pure data and will not be interpreted as SQL code.
Input validation and filtering:
Strictly validate and filter user input data to ensure it conforms to the expected format.
Minimize database user permissions:
Ensure that the account used to connect to the database has the minimum necessary permissions. Avoid using accounts with advanced permissions (such as' root 'or' admin ') for daily operations.
Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.
The text was updated successfully, but these errors were encountered:
Itsourcecode Online Blood Bank Management Authentication Bypass via SQL Injection to User page and Admin Console
Affected Product
Online Blood Bank Management System in PHP with Source Code
Vendor Homepage
https://itsourcecode.com/free-projects/php-project/online-blood-bank-management-system-in-php-with-source-code/
Version
1.0
Vulnerable Software
https://itsourcecode.com/wp-content/uploads/2021/02/Blood-Bank-Management-System-in-Php-with-Source-Code-1.zip
Requirements
There are no requirements for authentication to perform this attack.
Problem
Authentication Bypass via SQL Injection
Root Cause
A SQL injection vulnerability was found in the '/admin/index.php' file and the '/index.php file' of the 'Online Blood Bank Management System' project. The reason for this issue is that attackers inject malicious code from the parameter "user" and use it directly in SQL queries without the need for appropriate cleaning or validation. This allows attackers to forge input values, thereby manipulating SQL queries and performing unauthorized operations, allowing access to both the user console page as well as the admin user page.
Impact
Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, unauthorized administrative functions, sensitive data leakage, data tampering, comprehensive system control, and even service interruption, posing a serious threat to system security and business continuity.
Description
In Version 1.0 of the Online Blood Bank Management System application, a SQL injection vulnerability was found in the '/admin/index.php' file and the '/index.php file' of the 'Online Blood Bank Management System' project. The reason for this issue is that attackers inject malicious code from the parameter "user" and use it directly in SQL queries without the need for appropriate cleaning or validation. This allows attackers to forge input values, thereby manipulating SQL queries and performing unauthorized operations, allowing access to both the user console page as well as the admin user page.
No login or authorization is required to exploit this vulnerability
Proof-of-Concept
Working Payloads
Admin Console
User Console
Remediation Guidance
Use prepared statements and parameter binding:
Preparing statements can prevent SQL injection as they separate SQL code from user input data. When using prepare statements, the value entered by the user is treated as pure data and will not be interpreted as SQL code.
Input validation and filtering:
Strictly validate and filter user input data to ensure it conforms to the expected format.
Minimize database user permissions:
Ensure that the account used to connect to the database has the minimum necessary permissions. Avoid using accounts with advanced permissions (such as' root 'or' admin ') for daily operations.
Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.
The text was updated successfully, but these errors were encountered: