code-projects Pharmacy Management System add_new_supplier.php sql injection

Vulnerability

A critical SQL injection vulnerability exists in code-projects Pharmacy Management System version 1.0. The flaw resides in the /add_new_supplier.php endpoint, where the name parameter is not properly sanitized before being used in SQL queries. An attacker can inject arbitrary SQL commands through a GET request to this endpoint. The vulnerability is unpatched as of the publication date [2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication. By crafting a malicious GET request to /add_new_supplier.php with a manipulated name parameter containing SQL injection payloads, the attacker can execute arbitrary SQL commands. The provided proof-of-concept demonstrates a time-based blind injection technique using AND 1087=1087 to confirm the injection point [2]. No special privileges or user interaction are required.

Impact

Successful exploitation allows an attacker to extract sensitive data from the database, including supplier details and potentially other application data. The attacker can also modify or delete database records, leading to data integrity loss and potential disruption of operations. Given the critical severity, this could lead to full database compromise [2].

Mitigation

No official patch has been released by the vendor as of the publication date. The vendor website (code-projects.org) does not provide a security update or advisory for this version [1]. Users should consider disabling the vulnerable endpoint or implementing input validation and parameterized queries as a workaround. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time.