Unauthenticated SQL Injection in Microfinance Management System v1.0

1. Technical Summary

Microfinance Management System v1.0, when deployed with MySQL as its backend database, contains a critical SQL injection vulnerability in `/mims/updatecustomer.php`. User-controlled input passed through the `customer_number` (and/or `course_code`) parameter is concatenated directly into backend SQL statements without parameterized prepared statements or strict type casting, enabling remote attackers to alter query logic and execute arbitrary SQL commands.

2. Vulnerability Mechanics

• ›The endpoint `/mims/updatecustomer.php` accepts HTTP parameters (`customer_number` / `course_code`) directly from client requests.
• ›Because the application constructs dynamic SQL strings via direct variable interpolation rather than bound parameters, supplying crafted SQL syntax breaks out of the intended data context.
• ›An unauthenticated remote attacker over the network (`AV:N / PR:N`) can leverage boolean-based, time-based blind, or UNION-based SQL payloads to extract or modify backend MySQL database records.

3. Potential Business & Technical Impact

• Confidentiality (High): Full read access to sensitive financial and customer records stored in the underlying MySQL schema, including authentication credentials and personal data.
• Integrity (High): Ability to modify database records, tamper with financial/customer entries, or escalate application privileges.
• Availability (High): Potential disruption of database operations or unauthorized deletion of application tables.

4. Defensive Remediation Considerations

• Replace all string-concatenated SQL queries in `/mims/updatecustomer.php` and related data-access scripts with parameterized prepared statements (`PDO` with `ATTR_EMULATE_PREPARES = false` or `mysqli_prepare` / `mysqli_stmt_bind_param`).
• Enforce strict server-side input validation and allowlist schema checks for identifier parameters such as `customer_number`.
• Enforce authentication and role-based authorization checks before processing state-changing endpoints such as `/mims/updatecustomer.php`.
• Apply the principle of least privilege to the database connection account so the web application user cannot access unrelated schemas or file-system functions (`LOAD_FILE` / `INTO OUTFILE`).