Demokratian genera_select.php sql injection

Vulnerability

The vulnerability is an SQL injection in basicos_php/genera_select.php in Demokratian, a PHP voting application. The id_provincia GET parameter (function fn_filtro) is passed unsanitized into a SQL query. The code does not validate or escape input; the fix changes the filter function to fn_filtro_numerico. The attack requires no authentication. The affected version is any commit prior to [1] commit b56c48b519fc52efa65404c312ea9bbde320e3fa [1].

Exploitation

An attacker sends a crafted HTTP GET request to basicos_php/genera_select.php?id_provincia=. The payload can use SQL UNION injection, e.g. -1 union all select 1,2,3,4,database(). The attacker does not need any authentication, user interaction, or special network position; exploitation is remote over HTTP [1].

Impact

Successful exploitation allows the attacker to extract arbitrary data from the database, including all voter or application tables. The injection can retrieve database names, tables, and content, leading to a complete loss of confidentiality. The integrity and availability of data are not directly impacted unless the attacker performs write operations (not described) [1].

Mitigation

A patch is available in the commit b56c48b519fc52efa65404c312ea9bbde320e3fa in the Bitbucket repository [1]. The fix changes the filtering function from fn_filtro to fn_filtro_numerico which correctly sanitizes numeric input. Users should update to the master branch or apply the code change manually. No workaround other than patching is mentioned in the references [1].