Security: SQL Injection (4 vectors), Unauthenticated Message Read/Write, Forum Deletion IDOR

[lighthousekeeper1212]

Summary

13 security vulnerabilities found (6 CRITICAL, 5 HIGH, 2 MEDIUM). The root cause is 1-of-N inconsistency: ~80% of SQL queries use prepared statements, but ~20% use raw string concatenation.

Critical Findings

1. SQL Injection in Profile Page (CRITICAL)

File: profile.php:23

$sql = "select * from users where idUsers = ".$userid;  // $_GET['id'] concatenated

Exploit: profile.php?id=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12--

2. SQL Injection in Topics Page (CRITICAL)

File: topics.php:85

$sql .= "topic_cat = " . $_GET['cat'] . " and ";

3. SQL Injection in Poll Class -- All Methods (CRITICAL)

File: includes/poll.class.php:50,56,81,84,88,99,108,112
Every method in the Poll class concatenates user input directly into SQL.

4. SQL Injection in AJAX Message Retrieval (CRITICAL)

File: includes/get_message_ajax.php:7

$q = mysqli_query($conn, "SELECT * FROM messages WHERE conversation_id = ".$conversation_id);

$conversation_id = base64_decode of user-supplied $_GET['c_id'].

5. No Authentication on Message AJAX Endpoints (CRITICAL)

Files: includes/post_message_ajax.php, includes/get_message_ajax.php

• post_message_ajax.php has NO session_start() and NO auth check — anyone can send messages as any user
• get_message_ajax.php doesn't verify the requesting user belongs to the conversation

6. Forum Deletion Missing Ownership Check (CRITICAL)

File: includes/delete-forum.php:5
Any logged-in user can delete any forum topic. Compare with delete-category.php which correctly checks $_SESSION['userLevel'] == 1 (1-of-N).

High Findings

• Post Deletion Bypass (delete-post.php:5): Ownership check uses $_GET['by'] (attacker-controlled) instead of DB lookup
• Stored XSS (forum posts, blogs, messages): No htmlspecialchars() on user content
• Admin Pages Accessible (create-category.php, create-poll.php): Missing server-side admin check
• Hardcoded DB Credentials (includes/dbh.inc.php:3-6): root password in source
• Message Spoofing (message.php:168-170): Identity from client-side hidden inputs

Recommended Fixes

1. Use prepared statements for ALL queries (profile, topics, poll, messages)
2. Add session_start() + $_SESSION['userId'] check to AJAX endpoints
3. Check actual ownership in DB for delete operations, not client-supplied params
4. Apply htmlspecialchars() to all user-generated content
5. Move database credentials to .env file

---

Found via automated security audit by Lighthouse