Affiliate Me SQL Injection Vulnerability in Admin Panel

A SQL injection vulnerability has been identified in Affiliate Me version 5.0.1, specifically within the admin.php endpoint. This vulnerability allows authenticated administrators to manipulate database queries. By exploiting the 'id' parameter with crafted union-based queries, attackers can extract sensitive user information, including usernames and password hashes.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially access sensitive information such as user credentials. Additionally, a normal admin can exploit this vulnerability to escalate privileges to super admin.

Reproduction

To reproduce this vulnerability, an authenticated administrator can send a request to the admin.php endpoint with a crafted SQL injection payload in the 'id' parameter. The injected query can be designed to union select sensitive data from the database, such as usernames and password hashes.