Unauth UNION-based SQLi in admin/donate.php: POC, CVSS 9.8, and Fix Guide

Vulnerability Overview Vulnerability Title: Unauthenticated UNION-based SQL injection in admin/donate.php (location filter) #7 Vulnerability Type: SQL Injection (UNION-based, response-visible; CWE-89) Affected Version: Commit: b3a7b02c492c9984de5e1a83990d79687f82c Vulnerability Description: constructs a filter query based on raw POST data and renders result rows in the HTML page. A payload can directly return attacker-selected values (any database column) into the response. The lack of an call after session redirection causes the handler to execute without authentication, resulting in an anonymous, response-visible SQL injection that does not require blind injection techniques. Impact Anonymous, response-visible full database disclosure (credentials, feedback PII, donation data) - Easily automatable. Confirmed MySQL context as superuser (empty password, see CVE-17). No session, CSRF token, or role validation required. Affected Endpoint: Remediation 1. Use prepared statements and validate the parameter: - Use prepared statements and parameterized queries to prevent SQL injection. - Validate that the parameter matches a fixed list of allowed values (e.g., Chennai, Madurai, Coimbatore). 2. Enforce admin session and explicit role checks: - Enforce admin session validation and explicit role checks before invoking the handler. 3. Use least-privilege database accounts: - Use database accounts with minimal privileges, avoiding the use of the account. POC Code CVSS Score CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (9.8 Critical) Description: Full database read, superuser level, no restricted update access.

Goal Reached Thanks to every supporter — we hit 100%!

Unauth UNION-based SQLi in admin/donate.php: POC, CVSS 9.8, and Fix Guide

More from this source