WebMedium

SQL Injection: Login Bypass on VulnApp

Exploiting a classic SQL injection vulnerability in a login form to bypass authentication and gain admin access on a deliberately vulnerable web application.

Overview

VulnApp is a deliberately vulnerable web application hosted on a private lab environment. The target presents a standard login page with username and password fields. The objective is to bypass authentication without valid credentials and gain access to the admin dashboard.

Reconnaissance

Initial reconnaissance began with an Nmap scan revealing port 80 (HTTP) and port 22 (SSH) open on the target. Directory enumeration with Gobuster uncovered /admin, /login, and /api endpoints. The /login page uses a simple HTML form posting credentials to /api/auth. Inspecting the response headers revealed the backend runs PHP 8.1 with a MySQL database, as indicated by X-Powered-By and error leak headers.

Discovery

Testing the login form with a single quote in the username field returned a verbose MySQL error: "You have an error in your SQL syntax near '...". This confirmed the input is directly concatenated into a SQL query without sanitization. Further testing revealed the query structure: SELECT * FROM users WHERE username='[input]' AND password='[input]'.

Exploitation

The payload admin' OR '1'='1' -- - was injected into the username field with any value in the password field. This transforms the query into: SELECT * FROM users WHERE username='admin' OR '1'='1' -- -' AND password='anything'. The OR condition always evaluates to true, and the comment truncates the password check. The server responded with a 302 redirect to /admin/dashboard, confirming successful authentication bypass.

Explanation

The vulnerability exists because user input is directly interpolated into the SQL query string without parameterization or input validation. The application trusts client-supplied data, allowing an attacker to modify the query logic. The comment sequence (-- -) neutralizes the remaining query, making the password check irrelevant.

Mitigation

Use parameterized queries (prepared statements) for all database interactions. Implement input validation and sanitization on both client and server sides. Deploy a Web Application Firewall (WAF) to detect and block common injection patterns. Apply the principle of least privilege to database accounts. Enable detailed logging and monitoring for failed authentication attempts.

Code Samples

Vulnerable SQL query with direct string interpolation

1-- Vulnerable query (do NOT use in production)
2SELECT * FROM users WHERE username='$input' AND password='$password';

Remediated query using PDO prepared statements

1// Secure parameterized query
2$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :user AND password = :pass');
3$stmt->execute(['user' => $username, 'pass' => $hashedPassword]);

Reconnaissance commands used during enumeration

1# Nmap service scan
2nmap -sV -sC -oN nmap_scan.txt 10.10.10.50
3
4# Gobuster directory enumeration
5gobuster dir -u http://10.10.10.50 -w /usr/share/wordlists/dirb/common.txt -o dirs.txt