SQL Injection in Internship Management System

Executive Summary

This vulnerability is a Time-Based Blind SQL Injection found in the employer/login.php file of the Internship Management System 1.0. It occurs because the application directly concatenates untrusted input from the email parameter into an SQL query without proper parameterization or sanitization.

An attacker can exploit this by injecting SQL syntax into the email field during login attempts. This allows the attacker to manipulate the database query, causing delays that confirm the presence of the injection even without valid credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a remote attacker to perform SQL injection attacks on the system, potentially leading to unauthorized access to sensitive data stored in the database.

The attacker can manipulate the database queries to read, modify, or delete data, which can compromise the confidentiality, integrity, and availability of the system.

Since the vulnerability is remotely exploitable without authentication, it poses a significant security risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the employer/login.php endpoint for SQL injection, specifically targeting the email parameter. A common method is to perform a time-based blind SQL injection test by injecting SQL syntax that causes a delay in the database response.

• Use curl or similar tools to send crafted requests to the login endpoint with payloads that induce delays, such as: curl -X POST -d "email=anything' OR IF(SLEEP(5),1,0)-- &password=anything" http://target/employer/login.php
• Observe if the response time is significantly delayed, indicating a possible time-based blind SQL injection.
• Automated tools like sqlmap can also be used to detect this vulnerability by targeting the email parameter on the login endpoint.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing and parameterizing all inputs to the employer/login.php endpoint, especially the email and password parameters, to prevent SQL injection.

• Implement prepared statements or parameterized queries instead of directly concatenating user inputs into SQL queries.
• Apply input validation and escaping to ensure that malicious SQL syntax cannot be injected.
• If possible, temporarily restrict access to the vulnerable endpoint or monitor and block suspicious requests until a patch is applied.
• Update the system with any available patches or security updates from the vendor or project maintainers.

Useful 0 Not Useful 0