SourceCodester Best Church Management Software SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in SourceCodester Best Church Management Software version 1.1. The issue resides in the file '/admin/edit_slider.php', where the 'id' parameter is manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely, allowing attackers to perform time-based blind SQL injection and extract data from the application's database.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries to extract, modify, or delete database information. In this case, the vulnerability allows for time-based blind SQL injection, a technique where the attacker can infer data based on the time taken for the application to respond.

Reproduction

To reproduce this vulnerability, send a POST request to '/admin/edit_slider.php' with the 'id' parameter. The application will execute a SQL query that includes the 'id' value without proper sanitization, allowing for SQL injection. This vulnerability can be exploited using SQL injection tools like sqlmap, which can automate the process of finding and exploiting SQL injection vulnerabilities.