| عنوان | SourceCodester Simple Student Attendance System using PHP and MySQL 1.0 SQL Injection |
|---|
| الوصف | The vulnerability exists in the student_form.php file at line 6, where the id parameter is accepted without proper sanitization and validation. This id parameter is subsequently passed to the get_student() function located in actions.class.php at line 127. Due to insufficient input validation, this allows for SQL Injection attacks. Attackers can exploit this vulnerability to execute arbitrary SQL commands, leading to various types of SQL Injection attacks such as boolean-based blind, time-based blind, and UNION queries. Successful exploitation of this vulnerability resulted in unauthorized access to the database, disclosure of sensitive information, modification of data, or even complete compromise of the affected system. |
|---|
| المصدر | ⚠️ https://docs.google.com/document/d/1YkKZYuecpT5ZLtwgNBCYA-H-dfOhevYP2C-B4PBZv50/edit?usp=sharing |
|---|
| المستخدم | R0ck3t (UID 70759) |
|---|
| ارسال | 18/06/2024 07:57 PM (2 سنوات منذ) |
|---|
| الاعتدال | 20/06/2024 07:25 PM (2 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 247365 [SourceCodester Simple Student Attendance System 1.0 /modals/student_form.php id حقن SQL] |
|---|
| النقاط | 0 |
|---|