| عنوان | bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL 1.0 SQL Injection |
|---|
| الوصف | A SQL Injection vulnerability exists in the `username` parameter of the `admin_transaction.php` file in the Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL application, version <= v1.0.
The application directly incorporates the user-controlled `username` parameter into an SQL query without using prepared statements or sufficient parameterization. As a result, an attacker can provide specially crafted SQL input that alters the intended query structure.
The vulnerability is exploitable as a time-based blind SQL injection. By injecting database expressions that cause a measurable delay when a specified condition is true, an attacker can infer information from the database even when query results are not directly returned in the application's response.
Successful exploitation may allow an unauthenticated or authenticated attacker, depending on access to the affected functionality, to infer database information and potentially access or manipulate data within the privileges available to the application's database account.
The affected source code and reproduction details have been reported to the project maintainer through GitHub Issue #1:
https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/issues/1
|
|---|
| المصدر | ⚠️ https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/issues/1 |
|---|
| المستخدم | Sudais_Nazir (UID 99014) |
|---|
| ارسال | 20/09/2026 10:56 AM (17 أيام منذ) |
|---|
| الاعتدال | 05/10/2026 10:30 PM (15 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 413810 [bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL /admin_transaction.php حقن SQL] |
|---|
| النقاط | 20 |
|---|