Description

A SQL injection vulnerability was discovered in the endpoint responsible for searching for platform clients (Zentrajuris v.1.0). User input sent to the search parameter is concatenated directly into a SQL query without proper sanitization/parameterization, allowing the attacker to manipulate the query.

Affected endpoint

iqopgbljnxmxlzvzbvgy.supabase.co/rest/v1/clients

Payload example

Add the parameter ?select=*&limit=100 and alter the Accept header to application/json

Proof of Concept (PoC)

Impact

The SQL Injection vulnerability identified in the endpoint responsible for customer search poses a significant security risk to the platform, as it allows user-provided input to be interpreted directly as SQL commands by the database. This flaw allows a malicious attacker to manipulate queries to access, modify, or exfiltrate sensitive information, including customer personal data such as names, email addresses, identification documents, and other confidential information stored in the database. Furthermore, depending on the privilege level of the connection to the bank, exploitation of this vulnerability could result in unauthorized changes to records, data deletion, or even compromise of other areas of the system, affecting the integrity, confidentiality, and availability of platform information.

Mitigation

To mitigate this risk, it is recommended to immediately implement the use of prepared statements or parameterized queries, ensuring that all user-provided input is treated exclusively as data and not as part of SQL logic. Additionally, it is essential to apply strict input validation and normalization, restricting the accepted character types and ensuring that the provided parameters conform to expectations. This approach drastically reduces the possibility of malicious query manipulation, strengthening application security and protecting sensitive customer data from unauthorized access.