إرسال #678529: PHPGurukul User Registration & Login and User Management System With admin panel 3.3 SQL Injection

Multiple SQL Injection (CWE‑89) vulnerabilities were identified in the “User Registration and login System with admin panel” project (scanned copy located in loginsystem/). Static analysis with Semgrep (PHP + OWASP packs) flagged 53 SQL‑related findings across 28 PHP files, including authentication (login.php, admin/index.php), registration (signup.php), password recovery (password-recovery.php), profile management (edit-profile.php, user-profile.php), search/reporting (admin/search-result.php, admin/bwdates-report-result.php), and administrative user‑management scripts (admin/manage-users.php, admin/lastsevendays-reg-users.php, admin/lastthirtyays-reg-users.php, admin/yesterday-reg-users.php). The vulnerable pattern observed is direct interpolation or concatenation of user‑controlled input (e.g., $useremail, $password, $adminid, $searchkey, $fdate, $tdate, $fname, $lname, $email, $contact) into SQL query strings executed via mysqli_query(), enabling potential authentication bypass, unauthorized disclosure, modification or deletion of database records, and other impacts typical of SQL Injection. Findings were observed on 2025‑10‑20. In total, 53 SQL injection points were identified across the scanned PHP files, impacting both unauthenticated and authenticated administrative functionality. These vulnerabilities correspond to CWE-89 (SQL Injection) and pose a high risk for database compromise and unauthorized access.

• المصدر: ⚠️ https://github.com/NishantKumar-CSE/User-Registration-Login-and-User-Management-System-With-admin-panel/blob/main/Multple_SQL_Injection
• المستخدم: Nishant_Kumar (UID 91843)
• ارسال: 20/10/2025 02:40 PM (12 أشهر منذ)
• الاعتدال: 02/11/2025 07:29 AM (13 days later)
• الحالة: مكرر
• إدخال VulDB: 316239 [PHPGurukul User Registration & Login and User Management System /admin/manage-users.php حقن SQL]
• النقاط: 0