| عنوان | code-projects College Notes Uploading System 1.0 (Latest Official Source Code) SQL Injection |
|---|
| الوصف | The College Notes Uploading System developed in PHP has a critical SQL injection vulnerability in the login.php file. The login interface obtains user-controllable user and pass parameters through POST requests and directly splices them into SQL query statements.
The program incorrectly calls mysqli_real_escape_string() function but does not assign the escaped return value to variables, resulting in user input still being raw unsanitary data. Unauthenticated remote attackers can construct malicious SQL payloads to exploit this vulnerability, achieve login authentication bypass, arbitrarily query all database data, obtain user account plaintext passwords and other sensitive information, and cause serious information leakage and system security risks. |
|---|
| المصدر | ⚠️ https://github.com/XOB-Kongqi/SystemCng-SQL-Injection/blob/master/cng_sql.md |
|---|
| المستخدم | XOBKONGQI (UID 98315) |
|---|
| ارسال | 16/05/2026 07:51 PM (5 أشهر منذ) |
|---|
| الاعتدال | 04/06/2026 07:44 AM (18 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 338585 [code-projects College Notes Uploading System 1.0 /login.php user حقن SQL] |
|---|
| النقاط | 0 |
|---|