Warranty Tracking System SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Warranty Tracking System version 11.06.3. This issue allows attackers to execute arbitrary SQL queries by injecting malicious code through the 'txtCustomerCode', 'txtCustomerName', and 'txtPhone' POST parameters in 'SearchCustomer.php'. Exploitation of this vulnerability could lead to the extraction of sensitive database information, including usernames, database names, and version details.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially access or modify sensitive information in the database.

Reproduction

To reproduce this vulnerability, send a POST request to 'SearchCustomer.php' with injected SQL code in one of the vulnerable parameters: 'txtCustomerCode', 'txtCustomerName', or 'txtPhone'. The injected SQL code can be crafted to use 'UNION SELECT' to extract database information.