| عنوان | SourceCodestere Simple CRUD using PHP and FPDF V1.0 SQL Injection |
|---|
| الوصف | Validation Method
The finding was validated with sqlmap in a local authorized test environment. The sqlmap command and key output are included below so the parameter, injection type, payload, vector, backend DBMS, and any actual enumeration result can be reviewed.
Vulnerable Location
Affected File: app/register.php (line 12)
Vulnerable Parameter: firstname
Affected Endpoint: https://target.example/register.php
HTTP Method: POST
Vulnerability Overview
The Simple CRUD using PHP and FPDF application does not properly validate or sanitize user input for the firstname parameter. This results in a time-based blind SQL injection vulnerability. An attacker needs network access to the application and a valid authenticated user session. An attacker can construct and execute malicious SQL statements through the affected endpoint and backend SQL sink.
Problem Type and Root Cause
Type: SQL Injection
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Root Cause: User-supplied input from the firstname parameter flows into a raw SQL execution path without prepared statements, safe parameter binding, or strict allowlist validation. This allows attacker-controlled input to alter the intended query logic.
Impact
Attack Conditions: Network access to the endpoint and an authenticated authenticated user session are required.
Potential Impact: The verified evidence proves attacker-controlled SQL query alteration and backend DBMS fingerprinting. Depending on the affected query and application privileges, exploitation may support unauthorized data access or modification; final submission impact should remain limited to the collected evidence. |
|---|
| المصدر | ⚠️ https://github.com/cm126261/CVE/issues/2 |
|---|
| المستخدم | Smartiesxum (UID 102012) |
|---|
| ارسال | 15/10/2026 01:49 PM (24 أيام منذ) |
|---|
| الاعتدال | 08/11/2026 05:41 PM (24 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 432917 [SourceCodester Simple CRUD using PHP and FPDF 1.0 app/register.php firstname حقن SQL] |
|---|
| النقاط | 20 |
|---|