CVE-2018-18801

Vulnerability

The BSEN Ordering software version 1.0 (also referred to as E-Negosyo System) contains a SQL injection vulnerability in two endpoints accessible without authentication. The vulnerable parameters are the id parameter in student/index.php?view=view&id=[SQL] and index.php?q=single-item&id=[SQL]. The application fails to sanitize user-supplied input before constructing SQL queries, allowing an attacker to inject arbitrary SQL commands [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP GET request to either vulnerable endpoint. No authentication or prior user interaction is required. The exploit proof-of-concept demonstrates a blind SQL injection using a UNION-based technique that iterates over database columns to extract schema information. The attacker can use any SQL injection payload, such as the example UNION SELECT payload provided in the public exploit [1]. The vulnerability is remotely exploitable over the network [1][2].

Impact

Successful exploitation allows an attacker to read arbitrary data from the database, including potentially sensitive information such as user credentials, personal data, and application secrets. The attacker does not gain direct file write or remote code execution from this SQL injection, but the information disclosure can lead to further compromise depending on the database contents [1].

Mitigation

No official patch or updated version has been released by the vendor as of the publication date (2018-11-16). The software may be abandoned or end-of-life. Until a fix is available, the only mitigation is to remove or restrict access to the vulnerable endpoints, or implement web application firewall (WAF) rules to block SQL injection patterns. Users are advised to migrate to an alternative solution that is actively maintained [1][2].