| Title | SOURCECODESTER Auto Dealer Management System 1.0 / view_transaction.php id SQL Injection |
|---|
| Description | Auto Dealer Management System view_transaction.php parameter id is vulnerable to SQL Injection attack.
Vendor Homepage:
https://www.sourcecodester.com
Software Link:
https://www.sourcecodester.com/php/15371/auto-dealer-management-system-phpoop-free-source-code.html
Version:
v 1.0
Affected Page:
Vulnerable Page: view_transaction.php,
On this page, "id" parameter is vulnerable to SQL Injection Attack
URL of the vulnerable parameter is: ?page=vehicles/view_transaction&id=*
Description:
The auto dealer management system supports two roles of users, one is admin, and another is a normal employee. the detail of role is given below
- Admin user has full access to the system
- Employee user has only a few menu access i.e. dashboard, car models and vehicle (available and transaction)
- An employee could perform the SQL Injection by viewing the vehicle transaction from his/her profile. Therefore, low-privileged users could able to get the access full system.
Proof of Concept:
The following steps are involved:
- An employee view the vehicle transaction and could perform the SQL injection with a vulnerable parameter (?page=vehicles/view_transaction&id=5*)
- Full Payload to execute the SQL Injection on this URL: localhost/adms/admin/?page=vehicles/view_transaction&id=5%27+and+false+union+select+1,2,3,4,5,6,7,8,9,database(),version(),12,13,user()--+-
Recommendation:
Whoever uses this CMS, should update the code of the application in to parameterized queries to avoid SQL Injection attack:
Example Code:
$sql = $obj_admin->db->prepare("SELECT *, concat(firstname,' ',COALESCE(concat(middlename,' '), ''), lastname) as customer from `transaction_list` where id = :id ");
$sql->bindparam(':id', $id);
$sql->execute();
$row = $sql->fetch(PDO::FETCH_ASSOC); |
|---|
| Source | ⚠️ https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Auto%20Dealer%20Management%20System%20-%20SQL%20Injection%20-%201.md |
|---|
| User | navaidansari (UID 41266) |
|---|
| Submission | 02/18/2023 19:45 (3 years ago) |
|---|
| Moderation | 02/18/2023 20:33 (47 minutes later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 221481 [SourceCodester Auto Dealer Management System 1.0 view_transaction ID sql injection] |
|---|
| Points | 20 |
|---|