TheSystem SQL Injection Vulnerability Allowing Authentication Bypass

A SQL injection vulnerability has been identified in TheSystem version 1.0. This vulnerability allows attackers to bypass authentication by manipulating the 'server_name' parameter. Exploitation involves injecting malicious SQL code to retrieve unauthorized database records and potentially access sensitive system information. The issue arises because the application does not properly sanitize user input, allowing for the injection of SQL commands that can be executed by the database.

Impact

Exploitation of this vulnerability could lead to unauthorized access to database records and sensitive system information, following an authentication bypass.

Reproduction

To reproduce this vulnerability, log into the application and send a POST request to the '/data/' endpoint. Include a crafted 'server_name' parameter that contains SQL injection payloads, such as a simple tautology-based injection. The response should indicate successful exploitation, such as returning database records that should not be accessible.