SQL Injection in Multi-Vendor Online Grocery Management System

Executive Summary

This vulnerability is an error-based SQL injection found in the Multi-Vendor Online Grocery Management System version 1.0, specifically in the save_shop_type function within the classes/Master.php file. It occurs because the id parameter from a POST request is directly used in a SQL query without proper sanitization or parameterization.

The application uses PHP's extract($_POST) to assign POST parameters to local variables, which allows attackers to inject malicious SQL payloads. Additionally, the system returns raw MySQL error messages in JSON responses, enabling attackers to extract database information through error-based techniques.

By injecting a MySQL extractvalue() payload into the id parameter, attackers can force the database to embed arbitrary query results into XPath error messages, which are then exposed in HTTP responses. This creates a direct data extraction channel without needing timing analysis or out-of-band methods.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrator access can exploit this vulnerability to extract sensitive data from the database. This includes user credentials, personal information, order history, and database schema details.

The vulnerability allows attackers to retrieve database version, current user, admin password hashes, all usernames and password hashes, and enumerate database tables by sending crafted POST requests with malicious id parameters.

Such data exposure can lead to unauthorized access, data breaches, and further exploitation of the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending crafted POST requests to the vulnerable endpoints, particularly targeting the `id` parameter in the `save_shop_type` function within the `classes/Master.php` file. By injecting SQL payloads such as MySQL's `extractvalue()` function into the `id` parameter, you can observe if the system returns raw MySQL error messages in JSON responses, which indicates the presence of the SQL injection vulnerability.

A practical detection method involves using tools like curl or specialized SQL injection testing tools to send POST requests with malicious payloads and checking the HTTP response for database error messages.

• Example curl command to test the vulnerability by injecting a MySQL extractvalue payload into the `id` parameter:
• curl -X POST -d "id=1' and extractvalue(1,concat(0x7e,(select database()),0x7e))-- -" https://target-url/path_to_save_shop_type_endpoint

If the response contains database error messages or reveals database names or other information, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Implement prepared statements with parameterized queries to prevent SQL injection.
• Cast numeric parameters such as `id` to integers before using them in SQL queries.
• Suppress detailed error messages in JSON responses to avoid leaking database information.
• Disable PHP error output in production environments.

These steps will reduce the risk of exploitation by sanitizing inputs and preventing attackers from gaining useful information through error messages.

Useful 0 Not Useful 0

Compliance Impact

This SQL injection vulnerability allows attackers with administrator access to extract sensitive data such as user credentials, personal information, and order history from the database.

Exposure of such sensitive personal data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and health-related information against unauthorized access and breaches.

Therefore, exploitation of this vulnerability could result in violations of these standards due to unauthorized disclosure of protected data.

Useful 0 Not Useful 0