SQL Injection Leading to Administrator Authentication Bypass

Severity

Critical

CWE

CWE-89: Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection')

CVSS v3.1

9.8 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

A SQL Injection vulnerability exists within the application's authentication functionality. An attacker can inject malicious SQL syntax into the username parameter to bypass authentication and obtain unauthorized administrator access.

Successful exploitation allows an unauthenticated attacker to gain administrative privileges without knowledge of valid credentials.

Affected Endpoint

/index.php

Vulnerable Parameter

Username

Description

The application fails to properly sanitize user-supplied input before incorporating it into SQL queries.

By supplying a crafted SQL payload in the username field, the authentication logic can be manipulated, causing the application to treat the attacker as a valid administrator.

This results in complete authentication bypass and unauthorized access to privileged administrative functionality.

Steps To Reproduce

1. Navigate to the application login page.

1. Select:
2. User Type = Admin
3. Enter the following payload in the Username field:
4. ' OR 1=1 — -
5. Enter any value in the Password field.
6. Example:
7. test1234
8. Click Login.
9. Observe that authentication succeeds and the application redirects to the Administrator Dashboard.

Proof of Concept Payload

' OR 1=1-- -

' OR 1=1-- -

Expected Result

The application should reject invalid credentials and deny access.

Actual Result

Authentication is bypassed and administrative access is granted without valid credentials.

Impact

An unauthenticated attacker can obtain administrator privileges and perform privileged operations including:

• Access Administrator Dashboard
• Create administrator accounts
• Modify administrator accounts
• Delete administrator accounts
• Create categories
• Modify categories
• Delete categories
• Create promotional offers
• Delete promotional offers
• Access customer order information
• Access shipping information
• Perform privileged administrative actions

Successful exploitation results in complete compromise of application administration functionality.

Root Cause

User-controlled input is concatenated directly into SQL queries without proper parameterization.

Security Impact

• Authentication Bypass
• Privilege Escalation
• Administrative Account Takeover
• Unauthorized Access to Sensitive Data
• Integrity Compromise
• Potential Full Application Compromise

Recommendation

1. Implement prepared statements and parameterized queries.
2. Use server-side input validation.
3. Avoid dynamic SQL query construction.
4. Store passwords using password_hash().
5. Implement secure authentication controls.
6. Perform security testing on all authentication mechanisms.

References

OWASP SQL Injection Prevention Cheat Sheet

https://owasp.org/www-community/attacks/SQL_Injection