SQL Injection (Unauthenticated)

[4xpl0r3r]

SQL Injection (Unauthenticated)

Hello! I'd like to report an SQL injection vulnerability in your Chatbot web system, it doesn't require any authentication to trigger this vulnerability.

BTW, I found this type of vulnerability exists in your project for not only one time, here I just report one of them.

Analysis

In the /index.php, the $username parameter is embedded before prepare method, it means the SQL statement from the username POST parament will be executed directly.

Steps To Reproduce - PoC

1. Send a POST request with payload ' or 1=1 #
2. Now you can log in as any user you want
3. it's also possible to perform Boolean based blind injection here, which may lead to full compromise of your database.

Impact

This vulnerability may lead to full compromise of your database.

Recommendations

Check the PR Code

Change your code from

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$stmt = $db->prepare($sql);
$stmt->execute();

to

$sql = "SELECT * FROM users WHERE username=? AND password=?";
$stmt = $db->prepare($sql);
$stmt->execute([$username, $password]);

All the best!