| शीर्षक | code-projects Online Shopping System In PHP With Source Code 1.0 SQL Injection |
|---|
| विवरण | The Online Shopping System in PHP is affected by a time-based blind SQL injection vulnerability in the search functionality implemented by the action.php endpoint.
The vulnerable input is supplied through the keyword POST parameter while the search parameter is set to 1. The application does not appear to use a parameterized SQL statement when processing this value. Consequently, SQL metacharacters and expressions included in the search keyword may be interpreted as part of the application's database query rather than treated exclusively as search data.
The provided request injects an SQL expression containing the MySQL SLEEP(20) function. When the database evaluates the injected expression, execution is intentionally delayed for approximately 20 seconds. Because blind SQL injection may not return database errors or query results directly in the HTTP response, the observable response-time difference acts as a side channel confirming whether an injected condition was executed.
An attacker could use repeated true-or-false conditions and response timing to infer information from the database one value at a time. Depending on the database account's permissions and the data available to the application, this could expose user records, administrator information, password hashes, customer details, order data, product information, and the internal database structure.
The finding should be considered confirmed only when the delay is repeatable and is absent from an equivalent control request that does not contain the database delay expression. Network instability, application processing time, or server load should be ruled out before public disclosure.
|
|---|
| स्रोत | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20Online%20Shopping%20System%20%60keyword%60%20Parameter.md |
|---|
| उपयोगकर्ता | AhmadMarzook (UID 96211) |
|---|
| सबमिशन | 17/07/2026 09:04 PM (1 महीना पहले) |
|---|
| संयम | 30/08/2026 08:16 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397190 [code-projects Online Shopping System 1.0 Search Functionality /action.php keyword SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|