Pixa Bank SQL Injection Vulnerability

An SQL injection vulnerability has been identified in Pixa Bank version 2.0. This vulnerability allows unauthenticated attackers to inject SQL code into the 'rib' parameter, enabling them to extract sensitive user data such as names, email addresses, and phone numbers from the database. The exploitation occurs by sending POST requests with UNION-based SQL payloads to the 'agence-ajax.php' endpoint.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive user information stored in the database, including names, email addresses, and phone numbers.

Reproduction

The vulnerability can be reproduced by sending a POST request to the 'agence-ajax.php' endpoint with a crafted 'rib' parameter that includes SQL injection payloads. If the injection is successful, the response will contain extracted user data.