OpenBiz Cubi Lite SQL Injection Vulnerability in Login Form

A SQL injection vulnerability has been identified in OpenBiz Cubi Lite version 3.0.8. The issue resides in the login form, where unauthenticated attackers can manipulate database queries by injecting malicious SQL code through the username parameter. Exploitation of this vulnerability allows attackers to extract sensitive information from the database or bypass authentication altogether.

Impact

Exploitation of this vulnerability could lead to unauthorized access and manipulation of database information. Additionally, it could allow attackers to bypass authentication processes.

Reproduction

To reproduce this vulnerability, send a POST request to '/bin/controller.php' with the 'username' parameter containing the injected SQL payload. The injection can be crafted to exploit time-based blind SQL injection techniques, such as using 'SLEEP' commands to verify the injection's success.