SourceCodester Lost and Found Information System GET Parameter view.php sql injection

Vulnerability

The SQL injection vulnerability exists in SourceCodester Lost and Found Information System version 1.0, specifically in the file items/view.php. The id GET parameter is passed directly into an SQL query without proper sanitization or parameterization, creating a classic SQL injection flaw (CWE-89). The vulnerable page is accessed via /php-lfis/?page=items/view&id=ID. The vendor homepage is sourcecodester.com and the software link for the affected version is the Lost and Found Information System v1.0 [1].

Exploitation

An attacker can exploit this vulnerability remotely without any authentication or special privileges. The attack requires only that the target application is reachable over HTTP. The proof of concept provided by the discoverer involves visiting the vulnerable page with a crafted id parameter, copying the HTTP request to a text file, and running it through SQLmap for automated exploitation. A sample request targets GET /php-lfis/?page=items/view&id=5 HTTP/1.1 on the localhost [1]. The attacker can manipulate the id parameter to extract database contents, modify data, or perform other SQL commands.

Impact

Successful exploitation allows the attacker to compromise the confidentiality, integrity, and availability of the application's database. This can lead to extraction of sensitive information (such as user credentials, personal data, or system secrets), manipulation of data (inserting, updating, or deleting records), and potential escalation to further attacks depending on the database server's configuration and permissions [1]. The vulnerability is classified as critical due to the broad impact on all three CIA pillars.

Mitigation

As of the publication date (12 May 2023), no official patch has been released by SourceCodester for version 1.0. The vendor has not indicated whether an updated version is planned. Until a fix is available, the only mitigations are to restrict network access to the vulnerable page (e.g., via web application firewall rules or IP whitelisting) and to apply input validation and prepared statements on the id parameter in items/view.php. The vulnerability has been publicly disclosed with a proof of concept, increasing the risk of exploitation [1].