| عنوان | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection |
|---|
| الوصف | The affected component is the `farmers/` module (`add.php`, `edit.php`, `validate.php`). These files concatenate unsanitized `$_POST` fields (`f_no`, `f_id`, `f_name`, `f_locallity`, `f_ac`, `f_phone`) directly into SQL statements without any escaping or prepared statements. In `farmers/validate.php` the input is used inside `SELECT` queries, and in `farmers/add.php` / `farmers/edit.php` it is used inside `INSERT` / `UPDATE` statements:
```php
// farmers/validate.php
$idresult = mysqli_query($conn,"select * from farmers where f_id= '$f_id' ") or die("unable to fetch records" . mysqli_error($conn));
$noresult = mysqli_query($conn,"select * from farmers where f_no= '$f_no' ") or die("unable to fetch records" . mysqli_error($conn));
```
```php
// farmers/add.php
$sql = "INSERT INTO `farmers` ( `f_no` ,`f_id` , `f_name` , `f_locallity` , `f_ac` , `f_phone` ) VALUES( '{$_POST['f_no']}' ,'{$_POST['f_id']}' , '{$_POST['f_name']}' , '{$_POST['f_locallity']}' , '{$_POST['f_ac']}' , '{$_POST['f_phone']}' ) ";
mysqli_query($conn,$sql) or die(mysqli_error($conn));
```
```php
// farmers/edit.php
$sql = "UPDATE farmers SET f_no = '{$_POST['f_no']}' ,f_id = '{$_POST['f_id']}' , f_name = '{$_POST['f_name']}' , f_locallity = '{$_POST['f_locallity']}' , f_ac = '{$_POST['f_ac']}' , f_phone = '{$_POST['f_phone']}' WHERE f_no = '$f_no' ";
$rslt = mysqli_query($conn,$sql) or die(mysqli_error($conn));
```
Any authenticated user can exploit this because `farmers/add.php` performs no role check (even the lowest-privilege `Clerk` role is allowed). A time-based payload such as `1' OR SLEEP(4) -- -` in `f_id` produced a multi-second delay and a MySQL syntax error, confirming injection. The flaw allows an attacker to read, modify, or delete arbitrary database records (farmers, deliveries, employees), tamper with or reset the administrator password, and fully compromise the application database.
|
|---|
| المصدر | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/2 |
|---|
| المستخدم | 7z2Z (UID 101867) |
|---|
| ارسال | 02/10/2026 02:20 PM (17 أيام منذ) |
|---|
| الاعتدال | 18/10/2026 06:25 PM (16 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 421853 [Dav-ee dairy-management-system farmers/add.php mysqli_query f_no/f_id/f_name/f_locallity/f_ac/f_phone حقن SQL] |
|---|
| النقاط | 20 |
|---|