SQL Injection in code-projects Online Shopping System

A SQL injection vulnerability has been identified in the Login component of the code-projects Online Shopping System version 1.0. The vulnerability resides in the /login.php file, where the email parameter fails to properly sanitize user-supplied input before processing it in a database query. This flaw allows a remote, unauthenticated attacker to inject malicious SQL commands, potentially leading to unauthorized data access, modification, or bypass of authentication mechanisms. A public exploit is available, making this a significant risk for organizations deploying this software.

Attack Chain

1. Attacker performs reconnaissance to identify the target web application using the code-projects Online Shopping System 1.0.
2. Attacker navigates to the /login.php endpoint of the identified target.
3. Attacker crafts a malicious HTTP POST request targeting the 'email' parameter.
4. Attacker inserts SQL metacharacters (e.g., single quotes, OR clauses) into the email argument string.
5. The server-side /login.php script executes the unsanitized input as part of a database query.
6. The database executes the injected command, returning unauthorized results or altering state.
7. Attacker extracts data or bypasses authentication based on the successful database injection.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to compromise the backend database. This may result in the exfiltration of sensitive user information, credentials, or administrative access to the online shopping application. Given the severity of SQL injection, the entire integrity and confidentiality of the application's data layer are at risk.

Recommendation

• Monitor web application logs for suspicious characters (such as single quotes, double quotes, semicolons, or SQL keywords like UNION, SELECT, OR) appearing in the 'email' parameter of /login.php requests.
• Patch the vulnerable application immediately if an update is available from the vendor, or implement a Web Application Firewall (WAF) rule to drop POST requests containing common SQL injection signatures directed at /login.php.
• Audit current environment deployments for instances of Online Shopping System 1.0 and restrict access to the login endpoint until remediation is applied.