SourceCodester Free and Open Source Inventory Management System sql injection

An attacker sends a crafted POST request to the member page endpoint, replacing the value of the `columns[0][data]` parameter with a SQL injection payload. The advisory demonstrates a time-based blind injection using `(select*from(select+sleep(3)union/**/select+1)a)` [ref_id=1]. The attack is unauthenticated and can be launched remotely over HTTP. The parameter is not sanitized before being used in a SQL query, allowing the attacker to extract database contents.

The vulnerable endpoint is `/index.php?page=member` in the Free and Open Source Inventory Management System 1.0. The injection occurs in the `columns[0][data]` parameter of a POST request that the member page sends to retrieve customer data [ref_id=1]. The exact server-side function handling this parameter is not named in the advisory.

No patch is provided in the advisory. The researcher only documents the discovery and verification of the blind SQL injection using manual testing and sqlmap [ref_id=1]. To remediate, the application should use parameterized queries or prepared statements for the `columns[0][data]` parameter, and all user-supplied input should be validated and sanitized before being included in SQL queries.

1. Set up the environment: extract the PHP source code, create a MySQL database named "ample", import `ample/database/ample.sql`, and configure `ample/app/config/config.php` with database credentials [ref_id=1]. 2. Navigate to `http://ample/index.php?page=member` and use Burp Suite to capture the second POST request that loads customer data. 3. Replace the value of `columns%5B0%5D%5Bdata%5D` with the URL-encoded payload `%28select%2Afrom%28select%2Bsleep%283%29union%2F%2A%2A%2Fselect%2B1%29a%29` and forward the request. 4. Observe a 3-second delay and "No matching records found" in the response, confirming time-based blind SQL injection [ref_id=1]. 5. For automated verification, save the request to a file, replace the parameter value with `*`, and run `sqlmap -r "payload" --dbs --level 3` [ref_id=1].