FOXCMS Time-Based Blind SQL Injection Vulnerability in installdb.php

A time-based blind SQL injection vulnerability has been identified in FOXCMS versions through 1.25. The issue arises in the installdb.php file, where the url_prefix, domain, and my_website POST parameters are directly appended to SQL statements without adequate input sanitization. This vulnerability allows attackers to inject malicious SQL code that includes time-delay functions, such as SLEEP(). By monitoring the application's response times, attackers can deduce information from the database, such as database names, table structures, and other sensitive data, which could potentially lead to a complete database compromise.

Impact

Exploitation of this vulnerability allows for time-based blind SQL injection, where an attacker can manipulate SQL queries and infer database information based on the application's response time.