SourceCodester Garage Management System edituser.php sql injection

Vulnerability

A critical SQL injection vulnerability exists in SourceCodester Garage Management System version 1.0. The flaw resides in the /edituser.php script, where the id parameter is not properly sanitized before being used in a SQL query. An attacker can inject malicious SQL payloads, such as -2' UNION select 11,user(),333,444--+, to manipulate the query. The vulnerability is present in the default installation and does not require any special configuration to be exploitable [1].

Exploitation

Exploitation requires the attacker to first authenticate with valid admin credentials. The default credentials are admin / admin123. After logging in, the attacker sends a crafted HTTP GET request to /edituser.php?id=-2' UNION select 11,user(),333,444--+. The injected UNION clause retrieves the database user and other data, which is then reflected in the application response. No additional privileges or user interaction are needed beyond the initial login [1].

Impact

Successful exploitation allows the attacker to extract sensitive information from the database, such as database usernames, passwords (if stored in plaintext or hashed), and other application data. The attack can lead to complete disclosure of the database contents, potentially compromising the entire application and its users. The impact is limited to information disclosure; however, depending on the database configuration, further escalation (e.g., writing files or executing commands) may be possible [1].

Mitigation

As of the publication date (2022-07-29), no official patch or updated version has been released by SourceCodester. The vendor has not acknowledged the vulnerability. Mitigation requires manual input validation and parameterized queries in the /edituser.php script. Administrators should change default credentials, restrict network access to the admin panel, and consider using a web application firewall (WAF) to block SQL injection attempts. The software may be end-of-life; migrating to a supported alternative is recommended [1].