GHSA-qjv8-63xq-gq8m

Описание

Summary

A SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.

Proof of Concept

Vulnerable Code

File: modules/impianti/ajax/select.php:122-124

Data Flow

1. Source: $_GET['options']['matricola'] → $superselect['matricola']
2. Vulnerable: User input concatenated directly into IN() clause without sanitization
3. Sink: Query executed via AJAX framework

Exploit

Manual PoC (Time-based Blind SQLi):

SQLMap Exploitation:

SQLMap Output:

Impact

• Data Exfiltration: Time-based blind SQL Injection allows complete database extraction
• Authentication Bypass: Access to sensitive component and equipment data
• Data Manipulation: Potential unauthorized modification of records

Remediation

Cast values to integers before using in SQL:

Before:

After:

Credit

Discovered by: Łukasz Rybak