Key Information Vulnerability Description Type: SQL Injection in Geolocation Query Rating: CRITICAL Affected Components File: laravel/app/Http/Controllers/Front/StoreController.php Lines: 42-46, 73-80 Endpoint: POST /api/v1/front/store/list Authentication: Not Required Vulnerable Code Proof of Concept Exploited using sqlmap, demonstrating the ability to retrieve sensitive information such as database details, database name, table names, and user data. Remediation Recommendations 1. Input Validation (Recommended) - Validate and sanitize user input to ensure latitude and longitude values fall within reasonable ranges, preventing injection attacks. 2. Query Builder (Best Practice) - Use Laravel’s query builder to avoid directly embedding user input in SQL queries, reducing injection risks. 3. Abstraction Layer (DRY Principle) - Extract geolocation distance calculation logic into a service class to ensure code reusability and maintainability, while preventing SQL injection.