Client Management System 1.1 - 'Search' SQL Injection

vendor:

Client Management System

by:

BHAVESH KAUL

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Client Management System

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: Yes

Related CWE: N/A

CPE: a:phpgurukul:client_management_system:1.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux

2021

Client Management System 1.1 – ‘Search’ SQL Injection

Client Management System 1.1 is vulnerable to SQL Injection in the admin panel 'search invoices' field because of insufficient user supplied data sanitization. To exploit, an attacker can enter the payload ' OR 'x'='x' in the search field and all results are showed instead of none.

Mitigation:

The application should use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: Client Management System 1.1 - 'Search' SQL Injection
# Date: 14 June 2021
# Exploit Author: BHAVESH KAUL
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/client-management-system-using-php-mysql/
# Version: 1.1
# Tested on: Server: XAMPP

# Description #

Client Management System 1.1 is vulnerable to SQL Injection in the admin panel 'search invoices' field because of insufficient user supplied data sanitization.

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/clientms/admin/index.php
2) Login as admin using test credentials: admin/Test@123
3) Goto: http://localhost/clientms/admin/search-invoices.php
4) Enter the following payload in the search field: ' OR 'x'='x
5) All results are showed instead of none ==> SQL Injection success