berliCRM SQL Injection Vulnerability in 'src_record' Parameter

A SQL injection vulnerability has been identified in berliCRM version 1.0.24. The issue resides in the 'src_record' parameter, allowing remote attackers to manipulate database queries. By injecting malicious SQL code through a crafted POST request to the index.php endpoint, attackers could potentially extract or modify database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a POST request to the index.php endpoint with the 'src_record' parameter. Inject SQL payloads, such as ones exploiting time-based blind SQL injection, to manipulate the database query and extract or modify information.