Pedidos SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Pedidos version 1.0. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the 'q' parameter. The exploitation occurs via GET requests sent to the ajax/load_proveedores.php endpoint. Successfully exploiting this vulnerability could lead to the extraction of sensitive database information, including schema names and table structures.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could be used to manipulate the database or extract sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to the ajax/load_proveedores.php endpoint with a crafted SQL payload in the 'q' parameter. The injected SQL code can be designed to extract database information, such as schema names and table structures.