SourceCodester Online Book Store System SQL Injection Vulnerability Allowing Authentication Bypass

A SQL injection vulnerability has been identified in the admin login page of SourceCodester Online Book Store System version 1.0. This flaw allows remote attackers to manipulate the Username input, bypass authentication, and gain unauthorized access to the administrative dashboard. The vulnerability arises from inadequate input sanitization, enabling attackers to alter SQL queries and evade credential verification.

Impact

Exploitation of this vulnerability allows for unauthorized access to the administrative dashboard, with full administrative privileges. This access includes the ability to view and manage sensitive business and customer information, modify or delete records, and potentially take over the platform.

Reproduction

To reproduce this vulnerability, navigate to the admin login page of the affected application. In the Username field, enter a crafted payload that exploits the SQL injection vulnerability, such as a common SQL injection string that bypasses authentication. Enter any value in the Password field and submit the login form. The application will authenticate the user as an administrator, granting access to privileged functionalities.

Remediation

Developers are advised to use prepared statements and parameterized queries to prevent SQL injection vulnerabilities. Avoid constructing SQL queries dynamically with user input. Implement strict server-side input validation and use modern password hashing algorithms like bcrypt or Argon2. Additionally, establish logging and monitoring for authentication anomalies and conduct regular secure code reviews and penetration testing.