| Titel | PHPGurukul User Registration & Login and User Management System V3.3 V3.3 SQL Injection |
|---|
| Beschreibung | An authenticated SQL Injection (CWE-89) exists in “User Registration & Login and User Management System With Admin Panel” v3.3 at /loginsystem/admin/user-profile.php. The GET parameter uid is concatenated directly into a SQL string without validation or parameterization, enabling both boolean-based and time-based blind injection.
Vulnerable code (example):
$userid = $_GET['uid'];
$query = mysqli_query($con, "select * from users where id='$userid'");
Reproduction (after logging into the admin panel):
- Time-based blind (observe a ~5s delay):
uid=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))x)-- -
- Boolean-based blind (content/length difference):
uid=0' OR 1=1 -- -
Verified environment: Apache 2.4.39 / PHP 7.3.4 / MySQL ≥ 5.0.12
Impact:
- High confidentiality risk: attackers with an admin session can infer and extract sensitive database contents (e.g., users table: names, emails, contact numbers, registration dates).
- Moderate integrity risk through potential chaining with other admin-side injection points.
- Availability impact is low.
Remediation:
- Validate uid as an integer (e.g., ctype_digit + cast to int) and use prepared statements (SELECT * FROM users WHERE id = ?).
- Enforce server-side input validation and least-privilege DB credentials; consider output encoding for UI rendering.
Non-duplication note:
This issue specifically targets v3.3’s /admin/user-profile.php (uid, GET, admin-authenticated). It is distinct from previously disclosed injections in other endpoints (e.g., admin login handler or search-result.php) and no public CVE was found for this endpoint/version combination. |
|---|
| Quelle | ⚠️ https://github.com/romatdibrohiksnov/vulndb.com/blob/main/PHPGurukul%20User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20Admin%20Panel%20v3.3%20Authenticated%20SQL%20Injection%20in%20adminuser-profile.php%20(uid)%20.md |
|---|
| Benutzer | px_kanten (UID 90960) |
|---|
| Einreichung | 25.09.2025 10:43 (vor 1 Jahr) |
|---|
| Moderieren | 27.09.2025 19:17 (2 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 316238 [PHPGurukul User Registration & Login and User Management System /admin/user-profile.php SQL Injection] |
|---|
| Punkte | 0 |
|---|