| عنوان | code-projects Interview Management System in PHP 1.0 SQL Injection |
|---|
| الوصف | A SQL Injection vulnerability exists in the report viewing functionality of Interview Management System in PHP version 1.0.
The endpoint viewReport.php passes the GET parameter id to two methods in the View class. In both cases, $candId is directly concatenated into the SQL query string before being sent to PDO's prepare(). Because the user-controlled value is embedded in the query string prior to preparation, PDO's parameterization offers no protection:
In View::viewReport() (inc/classes/View.php):
function viewReport(){
$candId = $_GET['id'];
$sql = "select * from questions, reports, candidates where reports.cand_id = candidates.cand_id and reports.question_id = questions.question_id and reports.cand_id = $candId";
$query = $this->db->simplequerywithoutcondition($sql);
In View::viewReportComment() (inc/classes/View.php):
function viewReportComment(){
$candId = $_GET['id'];
$sql = "select * from comments where comments.cand_id = $candId";
$query = $this->db->simplequerywithoutcondition($sql);
Both SELECT queries join multiple tables and expose full row data from questions, reports, candidates, and comments tables. An attacker with valid credentials can use UNION-based injection to extract data from any other table in the database, including the user table containing login credentials. |
|---|
| المصدر | ⚠️ https://gist.github.com/c4ttr4ck/96ea33a23b47467051314fa704379336 |
|---|
| المستخدم | c4ttr4ck (UID 75518) |
|---|
| ارسال | 02/06/2026 08:21 PM (1 شهر منذ) |
|---|
| الاعتدال | 03/07/2026 08:33 PM (1 month later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 205667 [SourceCodester Interview Management System 1.0 /viewReport.php معرف حقن SQL] |
|---|
| النقاط | 0 |
|---|