Mallbuilder Add Brand User id SQL Injection Scanner

MallBuilder is a PHP and MySQL-based multi-user online shopping mall solution. It allows users to quickly set up an online marketplace similar to popular e-commerce platforms like Jingdong Mall, Tmall, or Store No.1. Its flexible architecture supports enterprise, industry, localized, and vertical multi-user malls, catering to diverse business needs. Aside from scalability, MallBuilder is favored for its ease of customization, making it ideal for businesses intending to enter the e-commerce market swiftly.

SQL Injection (SQLi) is a type of security vulnerability that allows attackers to interfere with the queries an application makes to its database. With SQLi, attackers can potentially view, modify, or delete data within the database, posing a significant risk to data integrity and confidentiality. This type of vulnerability typically occurs when user-controlled input is improperly sanitized before being used in an SQL query. As a result, attackers may execute arbitrary SQL commands.

The vulnerability specifically exists in the /brand/admin/add_brand_user.php endpoint, where the id parameter is directly concatenated into SQL queries without proper sanitization or parameterization. This allows an attacker to inject malicious SQL code through the id parameter, potentially bypassing authentication or altering brand user assignments. The lack of input validation makes this endpoint particularly susceptible to exploitation.

If successfully exploited, an attacker could gain unauthorized access to brand management functions, modify brand-user associations, or extract sensitive database information such as user credentials or business data. This could lead to privilege escalation, data breaches, or manipulation of the e-commerce platform's brand hierarchy, ultimately compromising the integrity and trustworthiness of the entire mall system.