"Grocery" PHP Application `search_products_itname.php` `sitem_name` Boolean-Based SQL Injection (CVE-2025-65354)

Metadata

Affected Target

Summary

The target is a PHP “Grocery” web application whose product-search endpoint, Grocery/search_products_itname.php, takes a sitem_name parameter that is concatenated into a backend SQL query without parameterization or escaping. This allows classic boolean-based blind SQL injection: an attacker sends paired requests with a true condition (-1' OR 5*5=25 --) and a false condition (-1' OR 5*5=26 --), plus a compound boolean payload (-1' OR 231=6 AND 000648=000648 --), and compares the responses to infer database contents one condition at a time. The included PoC script is thin and, as shipped, contains two functional bugs that keep it from working unmodified: it sends the SQLi payload as an HTTP header (sitem_name) rather than as the actual GET/POST form parameter the vulnerable PHP script reads, and its “random User-Agent” logic calls random.choice("user-agents.txt"), which picks a random character from the literal filename string instead of loading a line from the wordlist file. The underlying SQL injection payloads and the identified vulnerable endpoint/parameter are genuine; the delivery mechanism in the script needs to be corrected to actually reach the vulnerable parameter.

Vulnerability Details

Root Cause

The backend PHP endpoint Grocery/search_products_itname.php builds a SQL query using the sitem_name request parameter without sanitization or prepared statements (inferred from the classic boolean-based SQLi test payloads used against it; server-side source is not included in this repository). The PoC demonstrates the injection point with three payload variants sent as the value of sitem_name:

1
2
3

headers1 = {'Host': url, 'User-Agent': useragents, 'sitem_name': "-1' OR 5*5=25 --"}
headers2 = {'Host': url, 'User-Agent': useragents, 'sitem_name': "-1' OR 5*5=26 --"}
headers3 = {'Host': url, 'User-Agent': useragents, 'sitem_name': "-1' OR 231=6 AND 000648=000648 --"}

5*5=25 is a true tautology and 5*5=26 is false — a classic differential pair used to confirm boolean-based blind SQLi by diffing the two responses.

Attack Vector

1. Attacker identifies a target running the vulnerable “Grocery” PHP application and locates Grocery/search_products_itname.php.
2. Attacker submits the sitem_name parameter (as an actual GET/POST field — see Notes below on the script’s header-vs-parameter bug) with a true-condition payload, e.g. -1' OR 5*5=25 --, and records the response (status code, length, content).
3. Attacker submits the same request with a false-condition payload, e.g. -1' OR 5*5=26 --, and compares the response to the true case.
4. A consistent difference between true/false responses confirms boolean-based blind SQL injection; the attacker then iterates additional boolean conditions (e.g. -1' OR 231=6 AND 000648=000648 --) to extract database contents character-by-character or table/column existence bit-by-bit.
5. The script loops indefinitely, rotating a User-Agent header between requests to reduce trivial fingerprinting/blocking (as shipped this rotation does not actually read the wordlist file — see Notes).

Impact

Successful exploitation yields full boolean-based blind SQL injection against the backend database of the “Grocery” application — enabling extraction of arbitrary database contents (credentials, customer/order data, PII) and, depending on database privileges, potential further escalation (e.g., stacked queries, file read/write via INTO OUTFILE on MySQL).

Environment / Lab Setup

Target:   A running instance of the vulnerable "Grocery" PHP application,
          exposing /Grocery/search_products_itname.php and reading a
          "sitem_name" request parameter.
Attacker: Python 3
          requests
          (user-agents.txt included alongside the script, intended as a
          rotation pool, though the shipped code does not correctly read it)

Proof of Concept

PoC Script

See main.py (and user-agents.txt) in this folder.

1
2
3

pip install requests

python3 main.py

The script continuously sends the three sitem_name boolean payloads and prints each response’s status code, headers, and body for manual comparison/analysis.

Detection & Indicators of Compromise

- Repeated requests to /Grocery/search_products_itname.php containing SQL
  meta-characters ('  , -- , OR , AND) in the sitem_name value, whether sent
  as a form field or (per this script's bug) as a raw HTTP header
- Pairs/sequences of near-identical requests differing only in a trailing
  boolean expression (classic boolean-based blind SQLi probing pattern)
- Anomalous single-character or garbage User-Agent strings in access logs
  if a similarly-buggy UA-rotation routine reaches production traffic
- Database logs showing repetitive similarly-shaped queries against the
  product search table with only the WHERE clause's boolean tail changing

Signs of compromise:

• High-frequency automated requests to the product search endpoint from a single source.
• Application/database errors or unusual response-time variance correlated with sitem_name values containing quotes or SQL keywords.
• Evidence of successful data exfiltration (unusual read volume, unexpected result-set sizes).

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/EarthAngel666/CVE-2025-65354 on 2026-07-06. The repository ships only main.py and user-agents.txt with no README of its own. The PoC is thin and has two functional bugs as committed: (1) it hardcodes the target as https://www.example.com/Grocery/search_products_itname.php and sends the SQLi payload as a sitem_name HTTP header rather than an actual GET/POST parameter, so it would not reach the vulnerable code path unmodified; (2) random.choice("user-agents.txt") selects a random character from the literal filename string rather than reading a line from the file, so User-Agent rotation never actually engages the wordlist. The SQL injection payloads themselves and the identified vulnerable endpoint/parameter are genuine and reflect real boolean-based blind SQLi technique.