SourceCodester Canteen Management System edituser.php sql injection

Vulnerability

A SQL injection vulnerability exists in the edituser.php file of SourceCodester Canteen Management System version 1.0. The id parameter is directly concatenated into SQL queries without proper sanitization or parameterization, allowing an attacker to inject malicious SQL statements [1].

Exploitation

An attacker must first authenticate to the application. After logging in, they can access the Edit User functionality and manipulate the id parameter in the URL (e.g., GET /edituser.php?id=-7956' UNION ALL SELECT NULL,md5(1),NULL,NULL--+). The injected SQL payload is executed by the database, and results may be reflected in the page response [1].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands, potentially leading to data exfiltration, modification, or deletion of database contents. This can compromise the confidentiality, integrity, and availability of the application data [1].

Mitigation

No official patch has been released for this vulnerability as of the publication date. The vendor has not addressed the issue. Users should restrict network access to the Canteen Management System, apply input validation, and use parameterized queries to prevent SQL injection [1].