Solução

Planos

Recursos

Advisories

Empresa

Select Language



Contatar vendas

Fazer login

Teste gratuito

Select Language



Contatar vendas

Teste gratuito

Select Language





Advisories

Online Book Store Project 1.0 - Unauthenticated SQL Injection (SQLi)

9,8

Critical

Discovered by

Andres Roldan

Offensive Team, Fluid Attacks

Summary

Full name

Online Book Store Project 1.0 - Unauthenticated SQL Injection (SQLi)

Code name

Filth

State

Public

Release date

28 de set. de 2023

Affected product

Online Book Store Project

Affected version(s)

Version 1.0

Vulnerability name

Unauthenticated SQL Injection (SQLi)

Vulnerability type

146. SQL injection

Remotely exploitable

Yes

CVSS v3.1 vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 base score

9.8

Exploit available

Yes

CVE ID(s)

CVE-2023-43739

Description

The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database. The relevant vulnerable code is:

cart.php:

if(isset($_SESSION['cart']) && (array_count_values($_SESSION['cart']))){
    $_SESSION['total_price'] = total_price($_SESSION['cart']);
    $_SESSION['total_items'] = total_items($_SESSION['cart']);

if(isset($_SESSION['cart']) && (array_count_values($_SESSION['cart']))){
    $_SESSION['total_price'] = total_price($_SESSION['cart']);
    $_SESSION['total_items'] = total_items($_SESSION['cart']);

if(isset($_SESSION['cart']) && (array_count_values($_SESSION['cart']))){
    $_SESSION['total_price'] = total_price($_SESSION['cart']);
    $_SESSION['total_items'] = total_items($_SESSION['cart']);

if(isset($_SESSION['cart']) && (array_count_values($_SESSION['cart']))){
    $_SESSION['total_price'] = total_price($_SESSION['cart']);
    $_SESSION['total_items'] = total_items($_SESSION['cart']);

cart_functions.php:

function total_price($cart){
 $price = 0.0;
 if(is_array($cart)){
 foreach($cart as $isbn => $qty){
            $bookprice = getbookprice($isbn);
            if($bookprice){
                $price += $bookprice * $qty;
            }
        }
    }
    return $price;
}

function total_price($cart){
 $price = 0.0;
 if(is_array($cart)){
 foreach($cart as $isbn => $qty){
            $bookprice = getbookprice($isbn);
            if($bookprice){
                $price += $bookprice * $qty;
            }
        }
    }
    return $price;
}

function total_price($cart){
 $price = 0.0;
 if(is_array($cart)){
 foreach($cart as $isbn => $qty){
            $bookprice = getbookprice($isbn);
            if($bookprice){
                $price += $bookprice * $qty;
            }
        }
    }
    return $price;
}

function total_price($cart){
 $price = 0.0;
 if(is_array($cart)){
 foreach($cart as $isbn => $qty){
            $bookprice = getbookprice($isbn);
            if($bookprice){
                $price += $bookprice * $qty;
            }
        }
    }
    return $price;
}

database_functions.php:

function getbookprice($isbn){
    $conn = db_connect();
    $query = "SELECT book_price FROM books WHERE book_isbn = '$isbn'";
    $result = mysqli_query($conn, $query);
    if(!$result){
        echo "get book price failed! " . mysqli_error($conn);
        exit;
    }
    $row = mysqli_fetch_assoc($result);
    return $row['book_price'];
}

function getbookprice($isbn){
    $conn = db_connect();
    $query = "SELECT book_price FROM books WHERE book_isbn = '$isbn'";
    $result = mysqli_query($conn, $query);
    if(!$result){
        echo "get book price failed! " . mysqli_error($conn);
        exit;
    }
    $row = mysqli_fetch_assoc($result);
    return $row['book_price'];
}

function getbookprice($isbn){
    $conn = db_connect();
    $query = "SELECT book_price FROM books WHERE book_isbn = '$isbn'";
    $result = mysqli_query($conn, $query);
    if(!$result){
        echo "get book price failed! " . mysqli_error($conn);
        exit;
    }
    $row = mysqli_fetch_assoc($result);
    return $row['book_price'];
}

function getbookprice($isbn){
    $conn = db_connect();
    $query = "SELECT book_price FROM books WHERE book_isbn = '$isbn'";
    $result = mysqli_query($conn, $query);
    if(!$result){
        echo "get book price failed! " . mysqli_error($conn);
        exit;
    }
    $row = mysqli_fetch_assoc($result);
    return $row['book_price'];
}