code-projects Pharmacy Management System add_new_medicine.php sql injection

Vulnerability

A critical SQL injection vulnerability exists in code-projects Pharmacy Management System version 1.0. The flaw resides in the /php/add_new_medicine.php endpoint, where the name, packing, generic_name, and suppliers_name parameters are not properly sanitized before being used in SQL queries. An attacker can inject arbitrary SQL commands through these parameters, as demonstrated in the proof-of-concept request [2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication. By crafting a malicious GET request to /php/add_new_medicine.php with SQL injection payloads in any of the vulnerable parameters, the attacker can execute arbitrary SQL statements. The provided PoC uses a time-based blind injection technique with SLEEP() to confirm the injection [2]. The attack requires no special privileges or user interaction.

Impact

Successful exploitation allows an attacker to read, modify, or delete database contents, potentially exposing sensitive information such as supplier details, medicine records, and user credentials. The vulnerability can lead to complete compromise of the database integrity and confidentiality, and may enable further attacks on the application [2].

Mitigation

As of the publication date (2024-10-16), no official patch has been released for this vulnerability. The vendor (code-projects) has not provided a fix. Users are advised to implement input validation and parameterized queries to mitigate the risk. Until a patch is available, restricting network access to the vulnerable endpoint and applying web application firewall rules can reduce exposure [2].