Unauthenticated SQL Injection in Nur-Alam39 Bus-Ticket System

Executive Summary

This vulnerability is an unauthenticated SQL injection in the bus_info.php file of the Nur-Alam39 bus-ticket system. The busid parameter, received via HTTP POST, is directly concatenated into a MySQL query without any sanitization, escaping, or parameterization. Because the query is constructed in a numeric context without quotes, an attacker can inject arbitrary SQL code, such as a UNION-based payload, to read data from the bus_service database.

The application connects to the database as the MySQL root user with an empty password, which significantly increases the potential impact of this vulnerability. The query is executed using mysqli_query(), which does not allow multiple semicolon-separated statements, but the injection still allows data extraction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the bus_info.php endpoint for SQL injection via the busid parameter sent through HTTP POST requests.

A common detection method is to send specially crafted SQL injection payloads in the busid parameter and observe the response for unexpected data or errors.

• Use curl to send a POST request with a SQL injection payload, for example: curl -X POST -d "busid=-1 UNION SELECT 1,2,3,4,5,6" http://target-domain/bus_info.php
• Monitor the HTTP response for data that indicates successful injection, such as additional rows or database error messages.
• Use automated SQL injection detection tools like sqlmap targeting the bus_info.php endpoint with the busid parameter.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL queries on the bus_service database. This can lead to unauthorized disclosure of sensitive data stored in the database.

Because the database connection uses the MySQL root account with no password, the attacker could potentially access or manipulate all data within the database, leading to data breaches, data loss, or unauthorized data modification.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated remote attackers to perform SQL injection attacks, potentially exposing arbitrary data from the bus_service database.

Such unauthorized data access can lead to breaches of confidentiality, integrity, and availability of sensitive information.

This exposure and lack of proper access control and input validation can result in non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access.

Additionally, the use of the MySQL root account with no password further increases the risk of data compromise, exacerbating compliance issues.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing and parameterizing the busid input to prevent SQL injection.

Specifically, use prepared statements with parameterized queries instead of directly concatenating user input into SQL queries.

Additionally, change the database connection to use a non-root user with a strong password and least privileges necessary.

If possible, restrict access to the bus_info.php endpoint to trusted users or networks until a proper fix is implemented.

Review and update the code to validate and sanitize all user inputs before using them in database queries.

Useful 0 Not Useful 0