PHPGurukul Online Shopping Portal Project 2.0 - SQL Injection Vulnerability at admin login page in [/shopping/admin/index.php]

CVE-2024-9326

Exploit Title: PHPGurukul Online Shopping Portal Project 2.0 - SQL Injection

Exploit Author: SeaWind

Vendor Homepage: https://phpgurukul.com/

Software Link: https://phpgurukul.com/shopping-portal-free-download/

Version: 2.0

Vulnerable endpoint: http://localhost/shopping/admin/index.php

Tested on : Windows 11, XAMPP

Description and Impact

• In admin login page (http://localhost/shopping/admin/index.php ) an SQL Injection vulnerability was found at username parameter. This will allow attackers to access the admin panel page (for example http://localhost:88/admin/todays-orders.php) without any permission.

Step to reproduce

• First visit page http://localhost/shopping/admin/index.php

• Then at username parameter, add admin' -- - as the payload and in the password parameter, fill out with anything. In my example, I will fill username parameter with payload admin' -- - and 123 as the payload for password parameter

• Finally click login button, and with that, I was able to login to admin panel page without knowing the real password

Root Cause Analysis

<?php
session_start();
error_reporting(0);
include("include/config.php");
if(isset($_POST['submit']))
{
	$username=$_POST['username'];
	$password=md5($_POST['password']);
$ret=mysqli_query($con,"SELECT * FROM admin WHERE username='$username' and password='$password'");
$num=mysqli_fetch_array($ret);
if($num>0)
{
$extra="change-password.php";
$_SESSION['alogin']=$_POST['username'];
$_SESSION['id']=$num['id'];

header("location:change-password.php");
exit();
}
else
{
$_SESSION['errmsg']="Invalid username or password";
header("location:index.php");
exit();
}
}
?>

• This is the source code for user login in /shopping/admin/index.php. In the line 9 of the code, the query SELECT * FROM admin WHERE username='$username' and password='$password' doesn't have any validation or variable check before passing to this query at $username variable make it vulnerable to SQL Injection.