SQL Injection in CASAP-Automated-Enrollment-System update_class.php (CWE-89)

Vulnerability Overview Vulnerability Title: CASAP-Automated-Enrollment-System – SQL Injection in update_class.php (http://localhost/automated/update_class.php) Vulnerability Type: SQL Injection Affected Components and Parameters: Affected Endpoint: - URL: http://localhost/automated/update_class.php - HTTP Method: POST - Vulnerable File: update_class.php - Parameter: class_name - Vector Location: POST Injection Technique: Boolean Blind Injection: - Title: MySQL RLIKE Boolean Blind Injection - WHERE, HAVING, ORDER BY, or GROUP BY clause - Payload: Time-based Blind Injection: - Title: MySQL >= 5.0.12 Time-based Blind Injection (Query SLEEP) - Payload: Impact Scope Backend Database Management System (DBMS): MySQL >= 5.0.12 (MariaDB fork) CWE: CWE-89 (SQL Injection) Severity: High (placeholder - subject to adjustment after CVSS calculation) Impact: Enumeration of database schema, tables, and rows Exposure of sensitive user/operational data Potential subsequent attacks if credentials or session materials are stored in the database Remediation 1. Validate and Sanitize Input: Ensure all user input undergoes appropriate validation and sanitization to prevent SQL injection attacks. 2. Use Prepared Statements: Use prepared statements and parameterized queries to avoid directly concatenating user input into SQL queries. 3. Principle of Least Privilege: Ensure the database user used by the application has only the minimum necessary permissions. 4. Regular Security Audits: Conduct regular security audits and code reviews to discover and fix potential security vulnerabilities. Proof of Concept (POC) Code ```http POST /automated/update_class.php HTTP/1.1 Host: localhost Cookie: PHPSESSID=20200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020081120200811202008112020

Goal Reached Thanks to every supporter — we hit 100%!

SQL Injection in CASAP-Automated-Enrollment-System update_class.php (CWE-89)

More from this source