Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)

Summary


Name	Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)
Code name	Nergal
Product	Asset Management System
Affected versions	Version 1.0
State	Public
Release date	2023-09-28

Vulnerability


Kind	Unauthenticated SQL Injection (SQLi)
Rule	146. SQL Injection
Remote	Yes
CVSSv3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSSv3.1 Base Score	9.8
Exploit available	Yes
CVE ID(s)	CVE-2023-43013

Description

Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.

Vulnerability

The 'email' parameter of the index.php resource does not validate the characters received and it's sent unfiltered to the database. The vulnerable function is 'login()' located at core/functions/user.php:

function login($con,$email,$password){

    $user_id= user_id_from_email($con,$email);
    $password = md5($password);

    $query=mysqli_query($con,"SELECT * FROM `users` WHERE `email`= '$email' AND `password`='$password'");
    $result=mysqli_num_rows($query);
    return ($result==1) ? $user_id :false;

}