Executive Summary

The penetration test of http://testphp.vulnweb.com revealed multiple critical security vulnerabilities including SQL injection, reflected XSS, and local file inclusion. The application demonstrates classic web application security flaws that could lead to complete database compromise and arbitrary code execution.

Vulnerabilities Found

---

[CRITICAL] SQL Injection in listproducts.php

Field	Value
Severity	Critical
CVSS	9.8
CWE	CWE-89
Location	http://testphp.vulnweb.com/listproducts.php?cat=1

Description

The cat parameter in listproducts.php is vulnerable to SQL injection. SQLMap successfully identified multiple injection techniques including boolean-based blind, error-based, time-based blind, and UNION query injection.

Proof of Concept

Vulnerable Request:

curl "http://testphp.vulnweb.com/listproducts.php?cat=1"

Payload Used:

Standard SQLMap payloads for MySQL detection

Evidence (Response excerpt):

GET parameter 'cat' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
GET parameter 'cat' is 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)' injectable
GET parameter 'cat' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
GET parameter 'cat' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
target URL appears to have 11 columns in query

Impact

Complete database compromise including ability to extract sensitive data, modify database contents, and potentially execute operating system commands depending on database privileges.

Remediation

Implement parameterized queries/prepared statements for all database interactions. Validate and sanitize all user input before database queries.

---

[HIGH] Reflected Cross-Site Scripting (XSS) in search.php

Field	Value
Severity	High
CVSS	7.5
CWE	CWE-79
Location	http://testphp.vulnweb.com/search.php?test=

Description

The search functionality reflects user input directly into MySQL error messages without proper sanitization, creating a reflected XSS vulnerability.

Proof of Concept

Vulnerable Request:

curl "http://testphp.vulnweb.com/search.php?test=%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E"

Payload Used:

<script>alert('XSS')</script>

Evidence (Response excerpt):

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'XSS')</script>'' at line 1

Impact

Attackers can execute arbitrary JavaScript in victim browsers, leading to session hijacking, credential theft, and malicious actions on behalf of users.

Remediation

Implement proper output encoding/escaping for all user-controlled data. Use Content Security Policy (CSP) headers to mitigate XSS attacks.

---

[HIGH] Local File Inclusion in showimage.php

Field	Value
Severity	High
CVSS	7.5
CWE	CWE-22
Location	http://testphp.vulnweb.com/showimage.php?file=

Description

The showimage.php script is vulnerable to local file inclusion through the file parameter, though protected by open_basedir restrictions.

Proof of Concept

Vulnerable Request:

curl "http://testphp.vulnweb.com/showimage.php?file=../../../../../etc/passwd"

Payload Used:

../../../../../etc/passwd

Evidence (Response excerpt):

Warning: fopen(): open_basedir restriction in effect. File(../../../../../etc/passwd) is not within the allowed path(s): (/hj/:/tmp/:/proc/) in /hj/var/www/showimage.php on line 13

Warning: fopen(../../../../../etc/passwd): failed to open stream: Operation not permitted in /hj/var/www/showimage.php on line 13

Impact

While currently mitigated by open_basedir restrictions, this vulnerability could allow attackers to read sensitive files if restrictions are bypassed or misconfigured.

Remediation

Implement a whitelist of allowed files instead of accepting user input for file paths. Validate file paths against allowed directories and use basename() to prevent directory traversal.

---

[MEDIUM] Information Disclosure - Server Version

Field	Value
Severity	Medium
CVSS	5.0
CWE	CWE-200
Location	http://testphp.vulnweb.com/

Description

The server reveals detailed version information in HTTP headers and error pages.

Proof of Concept

Vulnerable Request:

curl -I "http://testphp.vulnweb.com/"

Evidence (Response excerpt):

Server: nginx/1.19.0
X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1

Impact

Version information aids attackers in identifying specific vulnerabilities and attack vectors for the disclosed software versions.

Remediation

Configure web server and PHP to suppress version information in headers and error pages.

Summary Table

#	Vulnerability	Severity	Location
1	SQL Injection	Critical	/listproducts.php?cat=
2	Reflected XSS	High	/search.php?test=
3	Local File Inclusion	High	/showimage.php?file=
4	Information Disclosure	Medium	Server headers

Recommendations

1. Immediate Priority: Fix SQL injection vulnerability in listproducts.php by implementing parameterized queries
2. High Priority: Implement proper input validation and output encoding to prevent XSS attacks
3. High Priority: Restrict file access in showimage.php using whitelisting approach
4. Medium Priority: Configure server to suppress version information disclosure
5. General: Implement a comprehensive security code review and testing process for all user input handling