SQL Injection in CodeAstro HRMS GetFileInfo via Base64-Decoded I Parameter

Vulnerability Overview Vulnerability Name: SQL Injection via Base64-Decoded I Parameter Leading to Unauthenticated Boolean, Error, and Time-Based SQL Injection in GetFileInfo Function Vulnerability Type: SQL Injection Vulnerability Description: In the HR management system developed by CodeAstro, the employee view functionality contains a critical SQL injection vulnerability. This vulnerability is located in the function, where the parameter is not sanitized. This allows attackers to inject arbitrary SQL queries, leading to database data leakage, modification, or service disruption. Impact Scope Affected Versions: v1.0 (Identified in public versions) CVSS Score: 9.8 Severity: Critical Backend Technologies: - DBMS: MariaDB 10.4.27 - Web Server: Apache 2.4.54 - Backend: PHP 7.4.33 Remediation Recommendations: - Remove direct SQL concatenation and use parameterized queries. - Implement input validation before decoding or processing the parameter. - Ensure that values resulting from base64 decoding are not blindly trusted. - Implement least-privilege database accounts and appropriate error handling to reduce the exposure of SQL errors. POC Code Exploitation Code Exploitation Confirmation ```plaintext sqlmap confirmation: [12:34:56] [INFO] testing connection to the target URL [12:34:56] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [12:34:56] [INFO] testing 'Boolean-based blind - Parameter replace' [12:34:56] [INFO] testing 'Time-based blind' [12:34:56] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns' [12:34:56] [INFO] testing 'MyS

Goal Reached Thanks to every supporter — we hit 100%!

SQL Injection in CodeAstro HRMS GetFileInfo via Base64-Decoded I Parameter

More from this source