code-projects Pharmacy Management System add_new_invoice.php sql injection

Vulnerability

A critical SQL injection vulnerability exists in the Pharmacy Management System version 1.0, specifically in the /add_new_invoice.php endpoint when processing the action=medicine_list parameter. The text parameter, used to search for medicines during invoice creation, is not properly sanitized before being used in SQL queries. This allows an attacker to inject arbitrary SQL commands. The vulnerable endpoint is /php/add_new_invoice.php?action=medicine_list&text=aa [2].

Exploitation

An attacker with network access to the web server and a valid session (as indicated by the PHP session cookie in the proof of concept) can send a crafted GET request to the vulnerable endpoint. The request includes a malicious value for the text parameter, such as a time-based blind SQL injection payload using SLEEP(). The proof of concept demonstrates that it is possible to inject SQL commands and observe time delays to confirm successful exploitation [2].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL queries against the database. This can lead to unauthorized disclosure of sensitive data (e.g., medicine inventory details, user credentials), as well as modification or deletion of records. The vulnerability compromises both the confidentiality and integrity of the system, and is classified as critical [2].

Mitigation

No official patch is available as of the publication date; the vulnerability status is reported as unpatched [2]. As a workaround, all user input, especially the text parameter, should be sanitized and validated. The use of parameterized queries or prepared statements is strongly recommended to prevent SQL injection attacks. Users should monitor for updates from the vendor and apply them when available.