| 제목 | itsourcecode Online Medicine Delivery System v1.0 SQL Injection |
|---|
| 설명 | 1. Description
The customer login interface /login.php of Online Medicine Delivery System contains an SQL injection vulnerability. The interface includes two login branches (sidebarLogin and modalLogin), both of which receive the user-submitted U_USERNAME parameter and directly concatenate it into an SQL query string without any filtering or parameterization, which is then passed to the Customer::cusAuthentication() method for execution.
An attacker can construct a malicious SQL statement in the U_USERNAME field (e.g., ' OR 1=1-- -), making the WHERE condition of the authentication query always true, and using a comment delimiter to bypass password verification, thereby successfully authenticating without knowing any account credentials and obtaining a customer session. This vulnerability can be exploited without any prior authentication.
2. Impact
(1) Unauthorized Customer Account Takeover: An attacker can log into any customer account without knowing any customer credentials, obtaining customer-level operational privileges
(2) Sensitive Data Disclosure: Upon successful login, the system writes the customer's full information (name, username, password hash, etc.) into the session, which the attacker can access through the profile page
(3) Business Data Tampering: After entering a customer account, the attacker can place orders, modify addresses, change passwords, and manipulate shopping carts and wishlists
3.Remediation
(1) Use Parameterized Queries
(2) Input Validation: Perform whitelist validation on user input before SQL execution; the username field should be verified against allowed character formats |
|---|
| 원천 | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/C-02-SQLi-Customer-Auth-Bypass_en.md |
|---|
| 사용자 | Weining Xiao (UID 88216) |
|---|
| 제출 | 2026. 07. 16. PM 02:14 (1 월 ago) |
|---|
| 모더레이션 | 2026. 08. 30. AM 09:44 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397112 [itsourcecode Online Medicine Delivery System 1.0 Customer Login Interface /login.php cusAuthentication U_USERNAME SQL 주입] |
|---|
| 포인트들 | 20 |
|---|