Description
Online Art Gallery v1.0 is vulnerable to an Unauthenticated SQL Injection vulnerability. The 'lnm' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. The vulnerable code is:
$fnm=trim($_POST['fnm']);
$lnm=trim($_POST['lnm']);
$gender=trim($_POST['gender']);
$contact=trim($_POST['contact']);
$email=trim($_POST['email']);
$pwd=trim($_POST['pwd']);
$dbpass=password_hash($pwd, PASSWORD_DEFAULT);
$confirm=trim($_POST['confirmpwd']);
$add1=trim($_POST['add1']);
$add2=trim($_POST['add2']);
$add3=trim($_POST['add3']);
...
$query="insert into user_reg (fname,lname,gender,contact,email,password,add1,add2,add3) value('$fnm','$lnm','$gender','$contact','$email','$dbpass','$add1','$add2','$add3')";
mysqli_query($link,$query) or die("Error inserting data.".mysqli_error($link));$fnm=trim($_POST['fnm']);
$lnm=trim($_POST['lnm']);
$gender=trim($_POST['gender']);
$contact=trim($_POST['contact']);
$email=trim($_POST['email']);
$pwd=trim($_POST['pwd']);
$dbpass=password_hash($pwd, PASSWORD_DEFAULT);
$confirm=trim($_POST['confirmpwd']);
$add1=trim($_POST['add1']);
$add2=trim($_POST['add2']);
$add3=trim($_POST['add3']);
...
$query="insert into user_reg (fname,lname,gender,contact,email,password,add1,add2,add3) value('$fnm','$lnm','$gender','$contact','$email','$dbpass','$add1','$add2','$add3')";
mysqli_query($link,$query) or die("Error inserting data.".mysqli_error($link));$fnm=trim($_POST['fnm']);
$lnm=trim($_POST['lnm']);
$gender=trim($_POST['gender']);
$contact=trim($_POST['contact']);
$email=trim($_POST['email']);
$pwd=trim($_POST['pwd']);
$dbpass=password_hash($pwd, PASSWORD_DEFAULT);
$confirm=trim($_POST['confirmpwd']);
$add1=trim($_POST['add1']);
$add2=trim($_POST['add2']);
$add3=trim($_POST['add3']);
...
$query="insert into user_reg (fname,lname,gender,contact,email,password,add1,add2,add3) value('$fnm','$lnm','$gender','$contact','$email','$dbpass','$add1','$add2','$add3')";
mysqli_query($link,$query) or die("Error inserting data.".mysqli_error($link));$fnm=trim($_POST['fnm']);
$lnm=trim($_POST['lnm']);
$gender=trim($_POST['gender']);
$contact=trim($_POST['contact']);
$email=trim($_POST['email']);
$pwd=trim($_POST['pwd']);
$dbpass=password_hash($pwd, PASSWORD_DEFAULT);
$confirm=trim($_POST['confirmpwd']);
$add1=trim($_POST['add1']);
$add2=trim($_POST['add2']);
$add3=trim($_POST['add3']);
...
$query="insert into user_reg (fname,lname,gender,contact,email,password,add1,add2,add3) value('$fnm','$lnm','$gender','$contact','$email','$dbpass','$add1','$add2','$add3')";
mysqli_query($link,$query) or die("Error inserting data.".mysqli_error($link));Our security policy
We have reserved the ID CVE-2023-44267 to refer to this issue from now on.
Disclosure policy
System Information
Version: Online Art Gallery v1.0
Operating System: Any
Mitigation
There is currently no patch available for this vulnerability.
References
