Authenticated SQL Injection Analysis (CWE-89) in PHP Application

Vulnerability Overview SQL Injection on every authenticated page (?id=, search, edit, and update endpoints) #4 All pages requiring authentication construct SQL queries by concatenating or values. Any authenticated student or teacher can inject SQL into these pages because the application prints raw output, allowing the pages to serve as an error extraction oracle for the entire database. Scope Affected Version: Commit Vulnerability Type: SQL Injection (Authenticated) Affected Code: - - - - - - - - - - - - - - - - - - Remediation Root Cause: The application used the deprecated API and manually constructed strings, never calling to sanitize request data (only the helper function was applied, but it was not applied to the field in ). only checks for the existence of a session and does not perform authorization checks on the requested object ID, allowing any logged-in user to target these queries. Reproduction Steps: 1. Log in as any teacher (e.g., the default account created via the registration process) and retain the session cookie. 2. Inject an error payload into the parameter of an authenticated page. 3. The same payload is also effective on , , , and . 4. Use statements to replace expressions, converting the same endpoints into full data extraction primitives, and convert endpoints into arbitrary write primitives. POC Code Impact Any authenticated user (including students) can read arbitrary data from the database, including plaintext passwords of other users, via error extraction or UNION primitives. Write endpoints ( , , , , , , , ) allow arbitrary INSERT/UPDATE injection, enabling modification of any row. There are no authorization checks restricting the session user, making horizontal and vertical privilege escalation trivial. Evidence Reproduction of an audit commit on a local deployment (response quoted verbatim; full transcription stored in ). CVSS CVSS v3.1 Base Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Calculation: exploitability = 8.22 x 0.85 x 0.77 x 0.62 (PR:L) x 0.85 = 2.84; impact = 6.42 x 1 - (1-0.56)^3 = 5.87; base = roundUp(2.84 + 5.87) = 8.8 Rationale: Only a low-privilege session (student account quality) is required, and with no object-level authorization in place, subsequent query injection provides full read and write access to the database, including plaintext passwords of other users.

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated SQL Injection Analysis (CWE-89) in PHP Application

More from this source