CVE-2025-63943 — SQL Injection in Grocery Store Management System 1.0

Overview

A high-severity SQL Injection vulnerability was identified in the search_products.php component of Grocery Store Management System 1.0, a PHP/MySQL-based web application created by anirudhkannan.
The issue arises from improper input validation and unsafe construction of SQL queries using the user-controlled scost parameter. This flaw enables attackers to manipulate the underlying SQL logic, potentially leading to sensitive data exposure, data alteration, or full compromise of the database.

---

Affected Product

• Name: Grocery Store Management System
• Vendor: anirudhkannan
• Version: 1.0
• Repository:
  https://github.com/anirudhkannanvp/GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN-/tree/master
• Affected File:
  Grocery/search_products.php

---

Vulnerability Description

The vulnerability exists due to the direct concatenation of unvalidated user input into SQL queries.
The scost POST parameter, intended to represent a numeric product cost value, is embedded into the SQL WHERE clause without:

• Input sanitization
• Type enforcement
• Parameterized queries
• Prepared statement usage

This allows an attacker to inject arbitrary SQL boolean expressions, altering query behavior and extracting database contents using boolean-based SQL Injection techniques.

The vulnerability is exploitable through a standard POST request to search_products.php. When malicious expressions are supplied, the backend returns measurable response differences (TRUE/FALSE variations), confirming that user input influences SQL logic.

---

Root Cause

• Lack of server-side validation on the scost input field
• Direct use of string concatenation for building SQL queries
• Absence of prepared statements in the affected code path
• No filtering or whitelisting for numeric input fields

These conditions collectively enable attackers to modify the intended SQL logic.

---

Severity & Impact

This vulnerability is rated High due to its low attack complexity, lack of authentication requirements, and full read/write database impact.

Potential Impacts Include:

• Sensitive data exposure: Attackers may extract product, user, or system data.
• Data modification or deletion: Injected SQL can alter or remove database entries.
• Authentication bypass (possible): If used in other parts of the application’s query logic.
• Full database compromise: Depending on DB privileges and configuration.
• System instability: Malicious queries could disrupt normal application behavior.

---

CVSS v3.1 Score (Preliminary Assessment)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Estimated Severity: High (9.8)

---

Exploitation Summary

The vulnerability can be exploited through crafted values passed to the scost parameter.
Attackers can:

• Influence boolean logic
• Trigger conditional responses
• Enumerate database structures
• Extract sensitive information

(Detailed payloads are intentionally omitted to prevent misuse.)

---

Mitigation & Recommendations

For Developers / Vendors

To remediate the vulnerability:

1. Implement prepared statements / parameterized queries
2. Enforce strict input validation — ensure scost accepts only numeric values
3. Reject suspicious characters — filter operators, quotes, comments, and expression symbols
4. Apply least-privilege database permissions
5. Audit the codebase for similar patterns elsewhere in the application

For Users

Until a patch is available:

• Restrict public access to the application
• Use a firewall or WAF to block malicious requests
• Monitor logs for unusual SQL-related behavior

---

References

• OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection
• CWE-89 — Improper Neutralization of Special Elements in SQL Commands