| Título | PHPGurukul Directory Management System v2.0 SQL Injection |
|---|
| Descripción | A SQL injection vulnerability exists in PHPGurukul Directory Management System 2.0 within the admin/forget-password.php component. The email and mobilenumber POST parameters are concatenated directly into an SQL query without sufficient validation or parameterized queries.
An unauthenticated remote attacker can manipulate the email parameter to make the password recovery query return a valid administrator record. The application subsequently allows the attacker to access the password reset workflow and set a new administrator password.
Successful exploitation can result in authentication bypass and complete administrator account takeover. |
|---|
| Fuente | ⚠️ https://github.com/baihu-art/PHPGurukul-Directory-Management-System-Project-V2.0 |
|---|
| Usuario | baihu (UID 88498) |
|---|
| Sumisión | 2026-09-24 06:02 (hace 1 mes) |
|---|
| Moderación | 2026-10-11 19:58 (18 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 308997 [PHPGurukul Directory Management System 2.0 forget-password.php email inyección SQL] |
|---|
| Puntos | 0 |
|---|