| عنوان | code-projects Interview Management System in PHP 1.0 SQL Injection |
|---|
| الوصف | A SQL Injection vulnerability exists in the question editing functionality of Interview Management System in PHP version 1.0.
The endpoint editQuestion.php retrieves the question to edit and processes an update through two methods in the application's class layer. In both cases, the GET parameter id is directly concatenated into the SQL query string before being passed to PDO's prepare(). Since PDO only prevents injection when placeholders (?) are used — not when variables are pre-embedded in the query string — the use of prepare() here provides no protection:
In View::viewEditQuestions() (inc/classes/View.php):
function viewEditQuestions(){
$questionId = $_GET['id'];
$sql = "select * from questions where question_id = $questionId";
$query = $this->db->simplequerywithoutcondition($sql);
In Create::editQuestion() (inc/classes/Create.php):
public function editQuestion($data){
$questionId = $_GET['id'];
$sql = "update questions set question = ? where question_id = $questionId";
$arr = array($question);
$results = $this->db->simplequery($sql, $arr);
Both queries execute immediately with the injected id value. The SELECT is exploitable for data extraction; the UPDATE allows modification of any question record by manipulating the WHERE clause. |
|---|
| المصدر | ⚠️ https://gist.github.com/c4ttr4ck/dfddf8167cfd8170def2578b3b6831af |
|---|
| المستخدم | c4ttr4ck (UID 75518) |
|---|
| ارسال | 02/06/2026 08:20 PM (1 شهر منذ) |
|---|
| الاعتدال | 03/07/2026 08:33 PM (1 month later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 208134 [janobe Interview Management System 1.0 editQuestion.php معرف حقن SQL] |
|---|
| النقاط | 0 |
|---|