PHPGurukul Beauty Parlour Management System SQL Injection Vulnerability in add-customer-services.php

A SQL injection vulnerability has been identified in PHPGurukul Beauty Parlour Management System version 1.1. The issue resides in the file '/admin/add-customer-services.php', where the 'sids[]' parameter is manipulated, allowing attackers to inject malicious SQL queries. This vulnerability can be exploited remotely, without any authentication.

Impact

Exploitation of this vulnerability allows attackers to inject SQL queries that could be used to access, modify, or delete database information. This could lead to unauthorized data exposure or manipulation, and in some cases, allow attackers to execute administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a POST request to '/bpms/admin/add-customer-services.php' with the 'sids[]' parameter. The request can include a payload that exploits the SQL injection, such as one that uses a time-based blind SQL injection technique, where the injected SQL query causes a delay in the response, indicating successful exploitation.

Remediation

It is recommended to validate and sanitize user inputs, particularly for parameters that are used in SQL queries. Implementing prepared statements can also help prevent SQL injection vulnerabilities by separating SQL code from user data.