Enviar #749260: code-projects Agro School Management System in PHP unknown sql

The application contains multiple instances of unauthenticated SQL injection in its user authentication and user-management endpoints. The login handler in index.php constructs SQL using raw request values:
$user_retrieve = $conn->prepare("SELECT * FROM users where username = '$username' and password = '$password'");
and user creation/update routines in admins/manage/users/btn_functions.php similarly build INSERT/UPDATE statements by concatenating input variables into SQL strings. Because user-controlled input is interpolated directly into SQL statements without proper parameterization or escaping, an attacker can inject SQL payloads to bypass authentication, enumerate or exfiltrate database contents, modify or delete records, and escalate privileges.

Affected components:
index.php — login authentication SQL is built from $_REQUEST values.
admins/manage/users/btn_functions.php — INSERT and UPDATE statements built by string concatenation.

Impact:
Authentication bypass (login bypass) allowing attacker access as arbitrary users.
Data disclosure (read arbitrary rows), data tampering (UPDATE/DELETE), and potential full compromise of application data.
When combined with weak credentials or privileged DB user, can lead to complete system compromise.

Proof-of-Concept (example, login bypass):
HTTP POST to login endpoint with:
username: ' OR '1'='1' --
password: (any value)
The injected payload causes the WHERE clause to evaluate true for all rows, allowing authentication bypass.

Reproduction steps:
Send a POST request to the login form endpoint (the form in index.php) with the username field set to ' OR '1'='1' -- and any password.
Observe successful login / session creation and access to protected pages.
For data exfiltration, craft boolean- or union-based payloads in input fields used in INSERT/UPDATE construction to extract data.
Technical evidence:
Direct concatenation of $_REQUEST / user-supplied variables into SQL strings without using bound parameters or stored procedures (see index.php and admins/manage/users/btn_functions.php).

Severity recommendation: HIGH

• Usuario: imcoming (UID 95032)
• Sumisión: 2026-01-30 11:24 (hace 8 meses)
• Moderación: 2026-02-07 15:55 (8 days later)
• Estado: Duplicado
• Entrada de VulDB: 230568 [code-projects Agro-School Management System 1.0 index.php Contraseña inyección SQL]
• Puntos: 0