SQL Injection Vulnerability in Royal Event Management System v1.0

1. Technical Summary

Royal Event Management System v1.0 is vulnerable to SQL injection via the `todate` parameter. Because date-filtering input is concatenated directly into SQL queries without strict date parsing or prepared statements, an attacker can manipulate query execution against the backend database.

2. Vulnerability Mechanics

• ›Reporting and filtering endpoints accept the `todate` parameter from user requests without enforcing strict ISO/date type validation.
• ›The raw parameter value is interpolated into an SQL statement, allowing crafted SQL payloads to alter the query structure.
• ›Under CVSS v3.1 (`8.8 HIGH`), an authenticated attacker can extract sensitive tables or alter application state.

3. Potential Business & Technical Impact

• Confidentiality (High): Disclosure of administrative credentials, client bookings, financial records, and stored personal data.
• Integrity (High): Potential privilege escalation to administrative roles or tampering with stored application data.
• Availability (High): Risk of database query exhaustion or destructive data manipulation.

4. Defensive Remediation Considerations

• Use parameterized prepared statements for all date-range and reporting queries involving `todate` and `fromdate` parameters.
• Enforce strict server-side date parsing (e.g., verifying strict `YYYY-MM-DD` format) before passing values to the data layer.
• Implement centralized data-access abstraction layers and defence-in-depth WAF/input filtering rules where legacy code cannot be immediately refactored.