CVE-2022-43291 - Canteen Management System v1. SQL Injection Vulnerability Exposed

A recent SQL injection vulnerability has been discovered in the widely-used Canteen Management System v1., through its 'editclient.php' component. Attackers can exploit this flaw to execute arbitrary SQL queries, potentially causing unauthorized access, data breach, and even complete system takeover. This post aims to provide detailed information on the vulnerability, its exposure, possible exploitation, and necessary mitigation steps. It also includes relevant code snippets and references to original sources.

Technical Background

Canteen Management System (CMS) v1. is a popular web-based software solution designed to manage various aspects of a canteen, including food ordering, menu management, and financial records. The vulnerability, identified as CVE-2022-43291, specifically affects the 'editclient.php' component accessible via the '/youthappam/editclient.php' URL.

Exploit Details

The vulnerability emerges from improper input validation in the 'id' parameter within the 'editclient.php' component. Attackers can inject SQL queries through the 'id' parameter, which are executed directly on the server-side database. The observed vulnerable code snippet is as follows:

<?php
    // ...
    $id = $_GET['id'];
    // ...
    $sql = "SELECT * FROM clients WHERE id = '$id'";
    $result = mysqli_query($conn, $sql);
    // ...
?>

The above snippet shows that the 'id' parameter value is extracted from user input via $_GET and included directly in the SQL query without validation or proper escaping. Consequently, an attacker can manipulate this parameter to execute malicious SQL queries.

For example, an attacker can craft a URL like

http://[target]/youthappam/editclient.php?id=5 OR 1=1

In this case, the SQL query becomes

SELECT * FROM clients WHERE id = '5 OR 1=1'

Resulting in the improper display of all records from the 'clients' table due to the '1=1' condition.

Although this example demonstrates a harmless information disclosure query, attackers can use more sophisticated SQL queries to modify, delete, or exfiltrate sensitive data from the application.

Mitigation Recommendations

To resolve this vulnerability, developers must implement input validation and proper parameterized SQL queries throughout the application. The following changes are advised:

Here is a safer revamped version of the previously mentioned code snippet

<?php
    // ...
    $id = $_GET['id'];
    if (!is_numeric($id)) {
        die("Invalid input");
    }
    // ...
    $stmt = mysqli_prepare($conn, "SELECT * FROM clients WHERE id = ?");
    mysqli_stmt_bind_param($stmt, "i", $id);
    mysqli_stmt_execute($stmt);
    $result = mysqli_stmt_get_result($stmt);
    // ...
?>

This revised code snippet includes input validation to ensure that the 'id' value is a numeric value. Moreover, it uses a prepared statement with bound parameters for executing the SQL query, preventing SQL injection attacks.

Conclusion

CVE-2022-43291 is a critical SQL injection vulnerability found in the Canteen Management System v1., impacting the 'editclient.php' component. It is vital to implement effective input validation, proper SQL query construction, and parameter binding to mitigate this security risk. In addition, developers and administrators should regularly review application code to identify and resolve vulnerabilities in a timely manner.

Original References

1. Canteen Management System v1.: https://www.sourcecodester.com/php/12243/canteen-management-system-using-phpmysqli-full-source-code.html
2. CVE-2022-43291 - National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2022-43291

Timeline

Published on: 11/09/2022 15:15:00 UTC
Last modified on: 11/10/2022 15:01:00 UTC