| Titel | phpgurukul User Registration & Login and User Management System V3.3 Authorization Bypass Through User-Controlled SQL Primary Key |
|---|
| Beschreibung | Title: SQL Injection in admin/index.php leads to unauthenticated admin login bypass in PHPGurukul User Registration & Login and User Management System v3.3
Product: PHPGurukul “User Registration & Login and User Management System With admin panel” v3.3
Component/Endpoint:
- Path: /loginsystem/admin/index.php
- Parameter: username (POST)
- Authentication: None (Pre‑Auth)
Vulnerability Type: SQL Injection (CWE‑89) → Authentication Bypass
Root Cause:
The application directly concatenates user input into an SQL query:
mysqli_query($con,"SELECT * FROM admin WHERE username='$adminusername' and password='$pass'");
This allows breaking out of the WHERE clause using a line comment to remove the password comparison.
Impact:
- Unauthenticated attacker can obtain an admin session and full control of the admin panel (read/modify/delete data).
- High risk to confidentiality, integrity, and availability.
Reproduction Steps:
1. 1.
Send a POST request to /loginsystem/admin/index.php with Content-Type: application/x-www-form-urlencoded.
2. 2.
Body: username=' OR 1=1 #&password=abc&login=Login
3. 3.
Expected: The response contains a redirect to dashboard.php and the browser lands on the admin dashboard (admin session established).
Affected Version:
- Confirmed: 3.3 (older versions may also be affected but not verified)
Distinction from existing CVEs:
- Not /admin/manage-users.php ID (CVE‑2025‑7543) and not /admin/user-profile.php uid (CVE‑2025‑7542); this issue is pre‑auth on admin/index.php username.
Suggested Fix:
- Replace raw queries with prepared statements and parameter binding.
- Stop using MD5 for passwords; use password_hash/password_verify.
CVSS v3.1 (proposed):
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H → 10.0 (Critical) |
|---|
| Quelle | ⚠️ https://github.com/romatdibrohiksnov/vulndb.com/blob/main/PHPGurukul%20User%20Registration%20%26%20Login%20and%20User%20Management%20System%20v3.3%20%20SQL%20Injection%20%E2%86%92%20Unauthenticated%20Admin%20Login%20Bypass.md |
|---|
| Benutzer | px_kanten (UID 90960) |
|---|
| Einreichung | 25.09.2025 09:32 (vor 1 Jahr) |
|---|
| Moderieren | 27.09.2025 19:17 (2 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 286190 [PHPGurukul User Registration & Login and User Management System /admin/index.php SQL Injection] |
|---|
| Punkte | 0 |
|---|