[Security] Multiple SQL Injection + Plaintext Password Storage — Critical Vulnerabilities

[abdurazzoqovjavohir700-dev]

Security Vulnerability Report

Researcher: Abdurazzoqov Javohir
Date: 2026-06-19
Severity: Critical
Affected Repo: online-shopping-system-advanced

---

Summary

Multiple critical security vulnerabilities were identified through source code analysis of this repository. The application is affected by SQL Injection in at least 5 endpoints and plaintext password storage/exposure in the admin panel.

---

Vulnerability 1 — SQL Injection in manageuser.php (Critical)

File: admin/admin/manageuser.php

$user_id = $_GET['user_id'];
mysqli_query($con, "delete from user_info where user_id='$user_id'");

Issue: $user_id is taken directly from $_GET with no sanitization and inserted into a DELETE query.

PoC:

GET /admin/admin/manageuser.php?action=delete&user_id=1'%20OR%20'1'='1

Impact: Attacker can delete all users from the database.

---

Vulnerability 2 — SQL Injection in edituser.php (Critical)

File: admin/admin/edituser.php

$user_id = $_REQUEST['user_id'];
mysqli_query($con, "update user_info set first_name='$first_name', ..., password='$user_password' where user_id='$user_id'");

Issue: All 5 parameters are unsanitized in an UPDATE query.

PoC:

POST /admin/admin/edituser.php
first_name=admin'-- -&user_id=1

---

Vulnerability 3 — SQL Injection in orders.php (Critical)

File: admin/admin/orders.php

$order_id = $_GET['order_id'];
mysqli_query($con, "delete from orders where order_id='$order_id'");

PoC:

GET /admin/admin/orders.php?action=delete&order_id=1'%20OR%20'1'='1

---

Vulnerability 4 — SQL Injection in addsuppliers.php (High)

File: admin/admin/addsuppliers.php

mysqli_query($con, "insert into user_info(first_name,...,password,...) values ('$first_name', ..., '$user_password', ...)");

---

Vulnerability 5 — SQL Injection in add_products.php (High)

File: admin/admin/add_products.php

mysqli_query($con, "insert into products (...) values ('$product_type','$brand','$product_name','$price','$details','$pic_name','$tags')");

---

Vulnerability 6 — Plaintext Password Exposure in Admin Panel (Critical)

Files: admin/admin/manageuser.php, admin/admin/index.php

echo "<td>$user_password</td>";

Issue: User passwords rendered directly in admin HTML table — visible to any admin user.

---

Vulnerability 7 — Plaintext Password Storage (High)

File: admin/admin/addsuppliers.php

Passwords inserted into database with NO hashing whatsoever.

---

Vulnerability 8 — Weak MD5 Password Hashing (High)

File: admin/server/server.php

$password = md5($password_1);

MD5 is cryptographically broken for passwords. Use password_hash() with bcrypt.

---

Recommendations

Fix	Action
SQLi	Use prepared statements (mysqli_prepare()) for ALL queries
Password exposure	Remove password column from all admin UI tables
Password storage	Hash with password_hash($pass, PASSWORD_BCRYPT)
CSRF	Add CSRF tokens to all state-changing forms

---

Disclosure

This analysis was performed on source code only — no live system was accessed. Reported here for responsible disclosure.

Researcher: abdurazzoqovjavohir700@gmail.com

CVE identifiers will be requested from MITRE for the Critical-severity SQL Injection vulnerabilities after reasonable maintainer response time.

[abdurazzoqovjavohir700-dev]

Hi @maintainer 👋

Thank you for your open-source contribution! I wanted to follow up on this security report.

Fastest path to get an official CVE number (2–5 days):

GitHub is an official CVE Numbering Authority (CNA) — meaning you can get a CVE assigned directly through GitHub without going through MITRE (which takes 2–4 weeks).

Steps:

1. Go to your repo → Settings → Security → Advisories
2. Click "New draft security advisory"
3. Fill in the details from this issue (I'm happy to help with the wording)
4. Click "Request CVE" — GitHub will assign a CVE number within a few days

This also gives proper credit to both the reporter and your project in the official CVE database.

Please let me know if you have any questions — I can provide any additional technical details needed for the advisory.

---

This vulnerability was reported following responsible disclosure guidelines with a 90-day public disclosure window (deadline: 2026-09-19).

[abdurazzoqovjavohir700-dev]

---

📬 Researcher Contact Information

Reported by: @abdurazzoqovjavohir700-dev
Email: abdurazzoqovjavohir700@gmail.com
GitHub Profile: https://github.com/abdurazzoqovjavohir700-dev

If you have any questions, need more technical details, or want help writing the GitHub Security Advisory (for CVE assignment), please reach out directly.

Note: This vulnerability has been reported to multiple security databases including huntr.dev, VulDB, and Exploit-DB for public CVE tracking.

Public disclosure date: 2026-09-19 (90-day responsible disclosure window)

[abdurazzoqovjavohir700-dev]

📋 Public Security Disclosure Record:

This vulnerability is officially documented at:
🔗 https://github.com/abdurazzoqovjavohir700-dev/security-disclosures-2026

The disclosure includes:

• Full technical details and Proof of Concept code
• CVSS scoring and CWE classification
• Remediation recommendations
• CVE assignment timeline

This report has been indexed by security databases including Google, GitHub Advisory search, and CVE aggregators. A CVE number will be assigned and linked here once issued by MITRE or GitHub CNA.

[MinisterForDubiousNetworkActivities]

look at the pull requests that was already reported dayss ago