code-projects Pharmacy Management System manage_supplier.php sql injection

An attacker sends a crafted GET request to `/php/manage_supplier.php?action=delete&id=` with malicious SQL appended to the `id` parameter [ref_id=1]. The request can be sent remotely without authentication, as demonstrated by the PoC which includes only a session cookie [ref_id=1]. The injected SQL payload (e.g., a BENCHMARK-based blind injection) is executed by the database, allowing the attacker to extract data, delete records, or perform other unauthorized operations [ref_id=1].

The vulnerable endpoint is `/php/manage_supplier.php` with the `action=delete` and `id` parameters [ref_id=1]. The `id` parameter is passed via GET request and is not sanitized before being used in a SQL query [ref_id=1].

No patch has been released for this vulnerability; the advisory explicitly lists the status as "Unpatched" [ref_id=1]. The recommended remediation is to implement proper input sanitization and parameterized queries for the `id` parameter in the supplier deletion functionality to prevent SQL injection [ref_id=1].

1. Ensure the Pharmacy Management System 1.0 is running and accessible (e.g., at `http://localhost:8080`). 2. Obtain a valid session cookie (e.g., `PHPSESSID=48068ce7875c00d88ca3aa2b9269b91f`). 3. Send a GET request to the vulnerable endpoint with a SQL injection payload in the `id` parameter: `GET /php/manage_supplier.php?action=delete&id=32%20AND%202813%3dBENCHMARK(5000000%2cMD5(0x4f74656e)) HTTP/1.1` Include the session cookie and appropriate headers as shown in the PoC [ref_id=1]. 4. Observe the database response or timing delay to confirm successful injection.