SQL Injection in Multi-Vendor Online Grocery Management System 1.0 via save_shop_type Parameter

Vulnerability Overview Vulnerability Name: Multi-Vendor Online Grocery Management System 1.0 - SQL Injection via Parameter (Error-Based) #3 Vulnerability Type: SQL Injection — Error-Based (CWE-89) Root Cause: The function in uses PHP's to assign POST parameters to local variables, then directly concatenates the variable into an SQL SELECT query without any sanitization or parameterization. Additionally, the application defines a function that returns the raw MySQL error string in the JSON response. By injecting a MySQL payload into the parameter, an attacker can force the database engine to return arbitrary query results in the XPath path error message, which is then returned verbatim in the HTTP response. This creates a fully reliable, out-of-band data extraction channel that does not require time-based analysis. Impact Scope Affected Product: Multi-Vendor Online Grocery Management System V1.0 Vulnerable File: (triggered via ) Version: V1.0 Impact: An attacker with administrative access can extract the complete contents of the database, including all user credentials, personally identifiable information (PII), order history, database schema, etc., in plaintext via the HTTP response. The same injection class exists in at least 10 other endpoints in and . Remediation 1. Use Prepared Statements: Replace all string-concatenated queries with parameterized queries. 2. Enforce Integer Type Casting: For ID fields, enforce integer type casting before use. 3. Suppress Error Details: Remove from all JSON responses; in production environments, log errors only on the server side. 4. Disable : Ensure that PHP error output is not sent to clients in production environments. Proof of Concept (POC) 1. Extract Database Version: Response: 2. Extract Current Database User: Response: 3. Extract Administrator Password Hash: Response: 4. Extract All Usernames and Password Hashes: Response: 5. Enumerate All Tables in the Database: Response: Other Vulnerable Endpoints

Goal Reached Thanks to every supporter — we hit 100%!

SQL Injection in Multi-Vendor Online Grocery Management System 1.0 via save_shop_type Parameter

More from this source