| Название | itsourcecode Online Medicine Delivery System v1.0 SQL Injection |
|---|
| Описание | 1. Description
The password recovery interface /passwordrecover.php of Online Medicine Delivery System contains an SQL injection vulnerability. The interface receives the user-submitted phonenumber parameter and directly concatenates it into two SQL statements without any filtering or escaping:
(1)SELECT query: In the Customer::find_phone() method, WHERE PHONE={$phone} enables numeric-type injection
(2)INSERT query: In passwordrecover.php:27, $_SESSION['phonenumber'] is directly concatenated into the INSERT INTO messageout statement
The particularity of this vulnerability lies in the SELECT+INSERT dual injection: the phonenumber parameter is first passed into a SELECT query to check whether the phone number exists, and if the query succeeds, it is further concatenated into an INSERT statement writing to the messageout table. An attacker can extract sensitive data from the database by constructing malicious SQL statements without any authentication. Since the query results are not directly echoed to the page, data can only be extracted through time-based blind injection.
2. Impact
(1) Full Database Data Disclosure: Through time-based blind injection, arbitrary data from any database and any table can be extracted character by character, including user password hashes, customer personal information, etc.
(2) No Authentication Required: This interface is a password recovery page, accessible and exploitable without any login
3. Remediation
(1) Use Parameterized Queries
(2) Input Type Validation: The phonenumber parameter should be numeric only
(3) Remove Secondary Concatenation in INSERT: $_SESSION['phonenumber'] should be validated before being stored in the session, and should not be directly used again in the INSERT statement |
|---|
| Источник | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/C-06-SQLi-Password-Recover_en.md |
|---|
| Пользователь | Weining Xiao (UID 88216) |
|---|
| Представление | 16.07.2026 14:23 (1 месяц назад) |
|---|
| Модерация | 30.08.2026 09:44 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 397116 [itsourcecode Online Medicine Delivery System 1.0 Password Recovery Interface /passwordrecover.php Customer::find_phone phonenumber SQL-инъекция] |
|---|
| Баллы | 20 |
|---|