| Título | sourcecodester Petrol pump management software 1.0 SQL Injection |
|---|
| Descripción | The Petrol Pump Management Software developed by SOURCECODESTER contains a critical SQL Injection vulnerability within its /admin/app/login_crud.php component. This vulnerability arises due to the application's failure to properly sanitize user inputs for the email field in the login process. Attackers can exploit this flaw by crafting malicious SQL queries, which are executed by the server without proper validation. The provided proof of concept demonstrates an attack where an SQL UNION SELECT query is injected through the email parameter, effectively bypassing authentication mechanisms to gain unauthorized access or manipulate the application's data. This particular vulnerability underscores the importance of employing prepared statements or parameterized queries in handling user inputs, thus mitigating the risks associated with SQL Injection attacks, which can lead to unauthorized access, data leaks, and potentially compromising the entire database system. |
|---|
| Fuente | ⚠️ https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/login_crud.php%20SQL%20Injection.md |
|---|
| Usuario | nochizplz (UID 64302) |
|---|
| Sumisión | 2024-02-29 04:53 (hace 3 años) |
|---|
| Moderación | 2024-03-01 07:54 (1 day later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 255375 [SourceCodester Petrol Pump Management Software 1.0 login_crud.php email inyección SQL] |
|---|
| Puntos | 20 |
|---|