Attack Chain

1. Attacker performs reconnaissance to identify the target web application using the code-projects Online Shopping System 1.0.
2. Attacker navigates to the /login.php endpoint of the identified target.
3. Attacker crafts a malicious HTTP POST request targeting the 'email' parameter.
4. Attacker inserts SQL metacharacters (e.g., single quotes, OR clauses) into the email argument string.
5. The server-side /login.php script executes the unsanitized input as part of a database query.
6. The database executes the injected command, returning unauthorized results or altering state.
7. Attacker extracts data or bypasses authentication based on the successful database injection.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to compromise the backend database. This may result in the exfiltration of sensitive user information, credentials, or administrative access to the online shopping application. Given the severity of SQL injection, the entire integrity and confidentiality of the application's data layer are at risk.

Recommendation

• Monitor web application logs for suspicious characters (such as single quotes, double quotes, semicolons, or SQL keywords like UNION, SELECT, OR) appearing in the 'email' parameter of /login.php requests.
• Patch the vulnerable application immediately if an update is available from the vendor, or implement a Web Application Firewall (WAF) rule to drop POST requests containing common SQL injection signatures directed at /login.php.
• Audit current environment deployments for instances of Online Shopping System 1.0 and restrict access to the login endpoint until remediation is applied.