# CVE-2025-52021 — Time-Based Blind SQL Injection in PuneethReddyHC / Online Shopping System Advanced (v1.0)
**CVE:** CVE-2025-52021
**Title:** Time-Based Blind SQL Injection via `product_id` parameter in `edit_product.php`
**Vendor / Repo:** PuneethReddyHC — https://github.com/PuneethReddyHC/online-shopping-system-advanced
**Affected Version:** 1.0 (branch/tag `master` at time of testing)
**Discoverer:** Hafiz Pradana Gemilang
**Disclosure status:** Vendor notified privately. Full exploit PoC withheld from public disclosure for user safety.
---
## Summary
A **time-based blind SQL injection** vulnerability was found in `admin/admin/edit_product.php` of the Online Shopping System Advanced v1.0. The `product_id` GET parameter is interpolated into a SQL query without proper validation or parameterization. An attacker can inject time-delay functions (e.g. `SLEEP`) to observe server response delays and infer database behavior, confirming a remote SQL injection point.
> Note: This advisory intentionally excludes a runnable exploit payload. Proof-of-concept details have been shared privately with the maintainer to allow remediation.
---
## Affected endpoint (example)
```
/admin/admin/edit_product.php?product_id=<value>
```
Example local testing URL:
```
http://<host>/online-shopping-system-advanced-master/admin/admin/edit_product.php?product_id=0
```
---
## Vulnerability details
- **Type:** SQL Injection (Time-Based Blind)
- **Parameter:** `product_id` (GET)
- **Location:** `admin/admin/edit_product.php`
- **Attack vector:** Remote (crafted URL); no authentication required if the admin endpoint is publicly accessible or reachable by the attacker.
- **Preconditions:** The endpoint must accept the `product_id` parameter and include it in a SQL statement without parameterization.
---
## Evidence (timing tests summary)
Timing-based injection attempts using database `SLEEP()` semantics produced measurable server-side delays consistent with successful injection:
- `SLEEP(6)` → observed response delay ≈ 6.01s
- `SLEEP(15)` → observed response delay ≈ 15.00s
- `SLEEP(0)` → baseline response delay ≈ 0.01s
These results indicate a blind SQL injection point that permits time-based inference. The database name observed during testing: `onlineshop`.
---
## Impact
Successful exploitation of this vulnerability allows attackers to:
- Confirm and enumerate database content via blind/time-based techniques.
- Exfiltrate data (schema, table names, rows) with automated tools (e.g. sqlmap) using time-based techniques.
- Potentially escalate to further compromise depending on database privileges and application context.
Estimated severity: **High**
---
## Reproduction (high-level)
1. Send a crafted request to the `product_id` parameter that includes time-delay SQL constructs (testing performed with `SLEEP()` variations).
2. Observe server response time to infer whether injected expression executed.
3. Repeated tests with different payloads allow automated extraction via time-based techniques.
> Full step-by-step PoC omitted from public advisory — contact the reporter for encrypted PoC under responsible disclosure terms.
---
## Recommended Remediation
1. **Use parameterized queries / prepared statements** for all database access. Do not concatenate user input into SQL strings.
- Example (PHP + PDO):
```php
$stmt = $pdo->prepare('SELECT * FROM products WHERE id = ?');
$stmt->execute([$product_id]);
```
2. **Validate and sanitize input**: treat `product_id` as an integer and validate accordingly (e.g. `filter_input(INPUT_GET, 'product_id', FILTER_VALIDATE_INT)`).
3. **Least privilege**: ensure the database user used by the web application has minimal privileges (avoid `DROP`, `ALTER`, `GRANT`, or administrative rights).
4. **Error handling**: avoid leaking database errors to the client. Use generic error messages and log detailed errors server-side.
5. **WAF / rate-limiting**: as a temporary mitigation, implement WAF rules to detect common SQLi patterns and enforce rate-limits to slow mass extraction attempts.
6. **Audit related endpoints**: review other admin endpoints and parameters for similar injection patterns.
---
## Suggested sqlmap command
*(Included for vendor/maintainer convenience — do not publish PoC payloads publicly)*
```
sqlmap -u "http://<host>/online-shopping-system-advanced-master/admin/admin/edit_product.php?product_id=0" --dbms=mysql --batch --level=5 --risk=3 --technique=T --time-sec=6
```
---
## References
- OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection
---
## Contact / Credits
**Discoverer:** Hafiz Pradana Gemilang
- Email: hafizpradana.gemilang21@gmail.com
- GitHub: https://github.com/hafizgemilang/CVE-2025-52021
Vendor / Repo: https://github.com/PuneethReddyHC/online-shopping-system-advanced
---
**Disclaimer:** This public advisory omits exploitable payloads to protect users. Full technical details and PoC are available to the vendor upon request under an agreed responsible disclosure policy.
登录后查看神龙缓存的 POC 文件快照
登录查看