SourceCodester Contact Manager SQL Injection Vulnerability in Export to VCF Feature

A critical SQL injection vulnerability has been identified in SourceCodester Contact Manager version 1.0, specifically within the export to VCF feature. The issue arises in the file '/endpoint/delete-contact.php', where the 'contact' parameter is manipulated, allowing attackers to inject SQL payloads. This vulnerability can be exploited remotely, with public knowledge of the exploit available.

Impact

Exploitation of this vulnerability allows for arbitrary SQL command execution on the database. This could lead to unauthorized data access, data manipulation, or potentially gaining elevated privileges on the application or server.

Reproduction

To reproduce this vulnerability, send a GET request to '/endpoint/delete-contact.php' with a crafted 'contact' parameter that includes SQL injection payloads. The injection can be verified by observing the application's response or by using automated tools like SQLMap.