CVE-2025-7461: SQL Injection Vulnerability Analysis in Modern Bag E-commerce System

🌐 Language / 语言: English | 简体中文

Vulnerability Overview

Vulnerability Database: https://vuldb.com/?id.316112

Project Source: https://code-projects.org/modern-bag-in-php-css-javascript-and-mysql-free-download/

Detailed Vulnerability Analysis

Vulnerability Location

Primary Vulnerability Point: Lines 272-289 in action.php

// Vulnerable code
if (isset($_POST["addToProduct"])) {
    if (isset($_SESSION["uid"])) {
        $p_id = $_POST["proId"];  // Direct user input retrieval
        $user_id = $_SESSION["uid"];
        
        // Direct concatenation into SQL query without any filtering
        $sql = "SELECT * FROM cart WHERE p_id = '$p_id' AND user_id = '$user_id'";
        $run_query = mysqli_query($con, $sql);
        $count = mysqli_num_rows($run_query);
        // ... subsequent code
    }
}

🔬 Root Cause Analysis

Lack of Input Validation

$p_id = $_POST["proId"]; 

The application directly accepts user input from the proId parameter without any validation or sanitization.

String Concatenation for SQL Construction

$sql = "SELECT * FROM cart WHERE p_id = '$p_id' AND user_id = '$user_id'";

The SQL query is constructed using direct string concatenation, making it vulnerable to injection attacks.

Inadequate Error Handling

$run_query = mysqli_query($con, $sql)
    or die(mysqli_error($con));  // ❌ Direct exposure of database errors

Database errors are directly exposed to attackers, providing valuable information for exploitation.

Report Prepared: 2025 Vulnerability ID: CVE-2025-7461 Severity: Medium (CVSS 3.1: 6.9) Status: Disclosed