🔬 Vulnerability Details

The admin login mechanism uses unsanitized input directly in SQL queries without any input validation or prepared statements:

This allows for injection payloads such as:

This bypasses authentication logic by evaluating to a true condition, thereby granting access to the admin dashboard.

📌 CWE Classification

📊 CVSS v3.1 Score

💥 Impact

A successful exploitation could result in:

• ✅ Full authentication bypass
• 🔓 Unauthorized access to privileged admin features
• 🛠️ Potential data leakage or manipulation using UNION-based SQL injection
• ⚠️ Full compromise of the backend database

🧪 Proof of Concept (PoC)

1. Clone the Repository

2. Host Locally

Use XAMPP/LAMP to deploy the project and navigate to:

3. Payload Injection

Enter the following credentials in the login form:

• Username: ' OR '1'='1
• Password: [any value]

You will be logged in as the first admin user, verifying successful SQL injection.

🔐 Recommendations

• ✅ Replace dynamic SQL queries with prepared statements (mysqli_prepare() or PDO).
• 🔍 Perform input validation and sanitization for all user inputs.
• 🧱 Deploy a Web Application Firewall (WAF) to block known SQL injection patterns.
• 🛡️ Conduct regular code audits and penetration testing for early detection.

📆 Timeline

🙋‍♂️ Credits

This vulnerability was discovered and responsibly disclosed by:

Aman Yadav

🔗 References

• OWASP - SQL Injection
• PortSwigger - SQL Injection
• CVE-2025-26198 on CVE.org

💬 This advisory is published independently due to lack of vendor response.