| عنوان | SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP N/A Improper Input Validation |
|---|
| الوصف | A vulnerability was found in Sourcecodester Dynamic Input Field Generator Using HTML, CSS, and PHP. This vulnerability affects the file public/submit.php. Processing of the argument "person" leads to improper input validation. The application does not check that each submitted value is a scalar string before passing it to a database insert function.
The function saveUser in includes/queries.php binds the value directly to a prepared statement using type s for string, with no prior type check in submit.php. If an attacker submits a nested array instead of the expected flat array for the person field, PHP does not throw an exception. Instead it emits an "Array to string conversion" warning and silently coerces the array into the literal string "Array", which is then written to the database as if it were valid input. The application reports the request as successful even though the submitted data was structurally invalid.
Proof of Concept:
Verified directly against a local instance of this codebase running PHP 8.3 and MySQL 8.0. Sending the following POST body instead of the expected flat array field:
POST to public/submit.php with Content-Type application/x-www-form-urlencoded and body: person open bracket 0 close bracket open bracket close bracket equals malicious
This produces the runtime warning: PHP Warning, Array to string conversion, in includes/queries.php on line 7. The literal string "Array" is inserted into the person table. No exception is thrown, the errors array remains empty, and the script proceeds as if the submission succeeded.
Impact:
Malformed input is silently coerced and persisted instead of being rejected, corrupting stored data with no error surfaced to the application or the end user. The application's own error handling is unreliable as a result: a request that should fail validation is instead reported as successful. In any system where this insert path feeds downstream reporting, deduplication, or search functionality, systematic pollution of records with the literal string "Array" could affect data integrity at scale.
Mitigation:
Explicitly validate that each element of the person array from POST data is a non-empty string (for example using is_string) before calling saveUser. Reject the entire request with an error if any entry fails validation, rather than silently coercing it to a string.
Vulnerability class: CWE-20 Improper Input Validation. |
|---|
| المصدر | ⚠️ https://gist.github.com/rionyxraiza/6b22a5e02da6b8581495761ff7393760 |
|---|
| المستخدم | Aswin K S (UID 99569) |
|---|
| ارسال | 06/07/2026 09:31 AM (2 أشهر منذ) |
|---|
| الاعتدال | 20/08/2026 09:38 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 393854 [SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP /public/submit.php saveUser حقن SQL] |
|---|
| النقاط | 20 |
|---|