| Titel | Fabian Ros Student File Management System in PHP 1.0 SQL Injection |
|---|
| Beschreibung | A SQL injection vulnerability exists in the Student File Management System (SFMS) v1.0 within the /admin/update_student.php file, where the stud_id, stud_no, firstname, lastname, gender, year, and section POST parameters are directly concatenated into an UPDATE SQL query without proper validation or parameterization, allowing authenticated attackers to inject malicious SQL statements through crafted HTTP requests, potentially leading to unauthorized modification of student records, data exfiltration, or complete compromise of the database integrity. |
|---|
| Quelle | ⚠️ https://gist.github.com/b1uel0n3/0a90bac3fdc187cea401eb9f1cdfa274 |
|---|
| Benutzer | b1uel0n3 (UID 93016) |
|---|
| Einreichung | 08.12.2025 15:22 (vor 10 Monaten) |
|---|
| Moderieren | 13.12.2025 10:02 (5 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 336308 [code-projects Student File Management System 1.0 update_student.php stud_id SQL Injection] |
|---|
| Punkte | 0 |
|---|