PHPGurukul Online Shopping Portal SQL Injection Vulnerability in Update Image Handler

A SQL injection vulnerability exists in PHPGurukul Online Shopping Portal Project version 2.1, specifically within the admin/update-image1.php file. The issue arises from the Parameter Handler component, where the filename parameter is manipulated, allowing attackers to inject malicious SQL code. This vulnerability can be exploited remotely, with public knowledge of the exploit available.

Impact

Exploitation of this vulnerability allows unauthorized database access, manipulation or deletion of data, leakage of sensitive information, and potential disruption of services.

Reproduction

The vulnerability can be reproduced by sending a POST request to the admin/update-image1.php file with a crafted filename parameter that includes SQL injection payloads. This can be done using tools like sqlmap, which automates the process of finding and exploiting SQL injection vulnerabilities.

Remediation

No specific mitigation measures are known for this vulnerability.