[Security] SQL Injection in admin/admin/orders.php via order_id (GET) (CWE-89)

[wyh533512-dev]

SQL Injection Vulnerability

File: admin/admin/orders.php
Line(s): 9-12
Parameter(s): order_id (GET)
Query Type: DELETE
Authentication: None (no authentication check before SQL execution)
CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
Severity: Critical (CVSS 9.8)

---

Vulnerable Code

$order_id=$_GET['order_id'];
mysqli_query($con,"delete from orders where order_id='$order_id'");

Description

The admin/admin/orders.php file in online-shopping-system directly concatenates user-supplied input into SQL queries without any sanitization, parameterization, or escaping. This allows an attacker to inject arbitrary SQL commands.

Additional vulnerable parameters in the same file: Also: page (GET) in pagination query (line 48)

Impact

• Data Exfiltration: Attacker can extract all database contents (user credentials, orders, payment info)
• Data Manipulation: Attacker can modify or delete records
• Authentication Bypass: Attacker can bypass login mechanisms
• Remote Code Execution: In some configurations, SQLi can lead to OS command execution via INTO OUTFILE or UDF

Remediation

Use prepared statements with parameterized queries:

$stmt = $con->prepare("SELECT * FROM products WHERE product_id = ?");
$stmt->bind_param("i", $_GET['product_id']);
$stmt->execute();

References

• OWASP SQL Injection
• CWE-89