NAME OF AFFECTED PRODUCT(S)
Vendor Homepage
submitter
Vulnerable File
VERSION(S)
Software Link
PROBLEM TYPE
Vulnerability Type
Root Cause
- An unauthenticated SQL Injection vulnerability exists in the id parameter of the /bank/mnotice.php endpoint. The application does not properly sanitize this parameter, allowing an attacker to manipulate database queries via a crafted GET request. The vulnerability can be verified using a tool like SQLMAP and could lead to the unauthorized disclosure of sensitive database information.
Impact
- Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, sensitive data leakage, data tampering, comprehensive system control, and even service interruption, posing a serious threat to system security and business continuity.
Vulnerability details and POC
Vulnerability location:
- GET /bank/mnotice.php?id=
Payload:
Parameter:
mnotice.php (GET) with id parameter
Payload:
GET /bank/mnotice.php?id=5'and(select*from(select/**/sleep(5))a/**/union/**/select+1)=' HTTP/1.1
Host: 127.0.0.1:82
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
sec-ch-ua: "Chromium";v="127", "Not)A;Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Accept-Language: zh-CN
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
The following are screenshots for POC:
The left pane displays an HTTP GET request made to the /bank/mnotice.php page. The attacker has injected a malicious payload into the id parameter.
The key part of this payload is select(sleep(5)). This is a command designed to force the backend database to pause all processing for 5 seconds before generating a response.
The right pane shows the server's response. Although the server simply redirects the user to login.php with a 302 status code, the crucial evidence is in the bottom right corner: the response time.
The request took 6,037 milliseconds (just over 6 seconds) to complete.
The significant delay (over 5 seconds) in the server's response directly corresponds to the sleep(5) command in the attack payload. This is definitive proof that the database executed the attacker's injected code, confirming that the id parameter is vulnerable to a time-based blind SQL Injection attack.
Suggested repair
-
Use prepared statements and parameter binding:
Preparing statements can prevent SQL injection as they separate SQL code from user input data. When using prepare statements, the value entered by the user is treated as pure data and will not be interpreted as SQL code.
-
Input validation and filtering:
Strictly validate and filter user input data to ensure it conforms to the expected format.
-
Minimize database user permissions:
Ensure that the account used to connect to the database has the minimum necessary permissions. Avoid using accounts with advanced permissions (such as' root 'or' admin ') for daily operations.
-
Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.
NAME OF AFFECTED PRODUCT(S)
Vendor Homepage
submitter
Vulnerable File
VERSION(S)
Software Link
PROBLEM TYPE
Vulnerability Type
Root Cause
Impact
Vulnerability details and POC
Vulnerability location:
Payload:
The following are screenshots for POC:
The left pane displays an HTTP GET request made to the /bank/mnotice.php page. The attacker has injected a malicious payload into the id parameter.
The key part of this payload is select(sleep(5)). This is a command designed to force the backend database to pause all processing for 5 seconds before generating a response.
The right pane shows the server's response. Although the server simply redirects the user to login.php with a 302 status code, the crucial evidence is in the bottom right corner: the response time.
The request took 6,037 milliseconds (just over 6 seconds) to complete.
The significant delay (over 5 seconds) in the server's response directly corresponds to the sleep(5) command in the attack payload. This is definitive proof that the database executed the attacker's injected code, confirming that the id parameter is vulnerable to a time-based blind SQL Injection attack.
Suggested repair
Use prepared statements and parameter binding:
Preparing statements can prevent SQL injection as they separate SQL code from user input data. When using prepare statements, the value entered by the user is treated as pure data and will not be interpreted as SQL code.
Input validation and filtering:
Strictly validate and filter user input data to ensure it conforms to the expected format.
Minimize database user permissions:
Ensure that the account used to connect to the database has the minimum necessary permissions. Avoid using accounts with advanced permissions (such as' root 'or' admin ') for daily operations.
Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.