thesystem App SQL Injection Vulnerability Allowing Authentication Bypass

A SQL injection vulnerability has been identified in thesystem App version 1.0. This vulnerability allows attackers to bypass authentication by manipulating the username parameter. By injecting malicious SQL code, such as ' or '1=1, into the username field, attackers can gain unauthorized access to user accounts. The vulnerability arises because the application does not properly sanitize input, allowing for the execution of arbitrary SQL commands that can manipulate the application's database queries.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling unauthorized access to user accounts.

Reproduction

To reproduce this vulnerability, send a POST request to the '/check_users/' endpoint with an injected SQL payload in the 'username' parameter. The application will respond with a success message, indicating that the injection was successful and access has been granted.