SQL Injection in ApiAdmin via User-List Endpoint

Executive Summary

This is a SQL injection vulnerability in ApiAdmin version 5.0 and earlier. The flaw exists in the admin user-list endpoint GET /admin/User/getUsers where the gid parameter is directly used in a raw SQL query without sanitization. This allows authenticated admin users to inject malicious SQL code.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability in ApiAdmin v5.0 or earlier, test the GET /admin/User/getUsers endpoint with the gid parameter. Use error-based payloads like ' OR 1=1-- to trigger database errors or time-based payloads like ' OR (SELECT * FROM (SELECT(SLEEP(5)))a)-- to observe delayed responses. Monitor for 500 errors or unusual delays indicating vulnerability.

• Send requests with malicious gid values to the endpoint and check for error messages or response delays.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access can exploit this to extract sensitive data like admin credentials (username, password hashes, nicknames) via error-based injection. Time-based blind injection can confirm vulnerability presence. The attack requires only admin panel access, no additional permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations and legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade ApiAdmin to a version beyond 5.0 that patches this flaw. If upgrading is not possible, restrict access to the /admin/User/getUsers endpoint to trusted IPs only. Implement input validation and use parameterized queries instead of raw SQL concatenation in the User.php file.

• Apply patches or updates from the vendor as soon as they are available.

Useful 0 Not Useful 0