SQL Injection Vulnerability in Purchase Order Management System (POMS)

Purchase Order Management System (POMS) version 1.0 is affected by a critical SQL injection vulnerability in its login authentication logic. The vulnerability exists within the 'password' parameter processed by '/purchase_order/classes/Login.php'. An attacker can send a crafted POST request to this endpoint to execute arbitrary SQL sub-queries. The proof-of-concept demonstrates the use of the MySQL 'load_file' function to perform an out-of-band (OOB) DNS lookup, which confirms that the application can be forced to interact with attacker-controlled external infrastructure. This vulnerability poses a significant risk to the integrity and confidentiality of the database connected to the application, as successful exploitation could lead to credential harvesting or database dumping.

Attack Chain

1. The attacker identifies the login endpoint at '/purchase_order/admin/login.php'.
2. The attacker crafts an HTTP POST request targeting '/purchase_order/classes/Login.php?f=login'.
3. The attacker injects a malicious SQL string into the 'password' field.
4. The payload utilizes the 'load_file' function to reference a UNC path, forcing a DNS request to an external domain.
5. The application backend processes the request and executes the injected SQL command.
6. The external OAST server (e.g., OASTify) receives the DNS query, confirming successful injection.
7. The attacker proceeds to extract sensitive information or bypass authentication mechanisms.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to interact with the underlying MySQL database. This can lead to unauthorized access to system credentials, the theft of sensitive procurement data, or potential further compromise of the web application environment.

Recommendation

1. Implement input sanitization and parameterization for all user-supplied data in 'classes/Login.php', specifically for the 'username' and 'password' parameters.
2. Deploy the provided Sigma rule to detect malicious SQL injection patterns in web server logs.
3. Block outbound DNS requests from the web application server to untrusted or non-whitelisted domains to prevent OOB exfiltration.
4. Audit logs for anomalous activity targeting the '/purchase_order/classes/Login.php' endpoint.