In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered.
My major concern is elevation of privileges, as almost all data except user data and credentials come from external systems and are overwritten every few minutes.
With the understanding that this would tackle elevation scenarios only, and that there are many other strategies that should also be followed, please provide feedback if this mitigation strategy would work:
- Create a passphrase in a config file, let's call it "admin-salt".
- Normal users log-in by providing a password, that is then hashed with a db-stored per-user-random salt and compared to the hash in the db. Admin users on the other hand log in by providing a password, that is hashed both with the random user-salt and the aforementioned admin-salt.
Therefore, to create a new admin user, elevate a user or change an admin users password, the database.users.passwordhash field must be filled with knowledge of the secret admin-salt. This happens programatticly if the user is created or elevated via backend and by an authenticated admin, while an sql injection leaves an admin user with an incorrect password hash.
Additional question: In case that's a viable approach and I didn't miss something obvious, why is it not more common practice?