Vran-Dev Databasir SQL Injection Vulnerability Allowing Arbitrary Code Execution

A SQL injection vulnerability has been identified in Vran-Dev Databasir versions 1.0.7 and prior. This vulnerability allows remote attackers to execute arbitrary code by manipulating the 'query' parameter in the search API endpoint. The issue arises because the application fails to properly sanitize input, enabling attackers to inject malicious SQL that is executed by the database.

Impact

Exploitation of this vulnerability allows for authenticated SQL injection, where an attacker can execute arbitrary SQL commands. This could lead to unauthorized data access, data manipulation, or in some cases, executing arbitrary code on the server, depending on the application's database interaction and environment.

Reproduction

To reproduce this vulnerability, send a GET request to the '/api/v1.0/search' endpoint with an injected SQL payload in the 'query' parameter. The injection can be crafted to, for example, use SQL injection techniques to extract data from the database or execute database commands that could impact the application.