VehicleWorkshop 1.0 - 'bookingid' SQL Injection

vendor:

VehicleWorkshop

by:

Mehran Feizi

9.0

CVSS

HIGH

SQL Injection

CWE

Product Name: VehicleWorkshop

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:spiritson:vehicleworkshop

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows

2020

VehicleWorkshop 1.0 – ‘bookingid’ SQL Injection

VehicleWorkshop 1.0 is vulnerable to SQL Injection. The vulnerability exists due to user-supplied input to the 'bookingid' parameter in '/viewtestdrive.php' not being properly sanitized before being used in SQL queries. An attacker can leverage this vulnerability to execute arbitrary SQL commands in the context of the application's database user.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: VehicleWorkshop 1.0 - 'bookingid' SQL Injection 
# Data: 2020-02-06
# Exploit Author: Mehran Feizi
# Vendor HomagePage: https://github.com/spiritson/VehicleWorkshop
# Tested on: Windows
# Google Dork: N/A


=========
Vulnerable Page:
=========
/viewtestdrive.php


==========
Vulnerable Source:
==========
Line6: if(isset($_GET['testid']))
Line8: $results = mysql_query("DELETE from testdrive where bookingid ='$_GET[testid]'");
Line11: if(isset($_GET['testbid']))
Line13: $results = mysql_query("UPDATE testdrive SET status='Approved' where bookingid ='$_GET[testbid]'");
Line16: if(isset($_GET['testbida']))
Line:18: $results = mysql_query("UPDATE testdrive SET status='Rejected' where bookingid ='$_GET[testbida]'");

=========
POC:
=========
http://site.com/viewtestdrive.php?bookingid=[SQL]