| Titre | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection |
|---|
| Description | The affected components are `payment/pay.php` and `reports/farmer_monthly.php`. These files escape user input with `mysqli_real_escape_string()` but then concatenate it into SQL **without surrounding quotes**, so escaping provides no protection — an attacker can inject operators such as `OR 1=1` or `AND SLEEP(n)` without using any quote character:
```php
// payment/pay.php
$f_no = mysqli_real_escape_string($conn, $_GET['f_no']);
$farmer = mysqli_fetch_array(mysqli_query($conn,"select f_no,f_name,last_paid,f_ac from farmers where f_no=$f_no"));
$result = mysqli_query($conn,"SELECT * FROM `delivery` WHERE r_f_no=$f_no and `r_dt` >='$start' and `r_dt` <= '$end'") or trigger_error(mysqli_error($conn));
```
```php
// reports/farmer_monthly.php
$f_no = mysqli_real_escape_string($conn, $_REQUEST['farmer']);
$result = mysqli_query($conn,"SELECT * FROM `delivery` WHERE r_f_no=$f_no $start $end") or trigger_error(mysqli_error($conn));
```
The endpoints are reachable by any authenticated user (no role restriction). `farmer=0 OR 1=1` in `farmer_monthly.php` returned all delivery rows while `farmer=0` returned none, and `f_no=1 AND SLEEP(3)` in `pay.php` caused a ~12 second delay, confirming injection. The flaw allows an authenticated attacker to read arbitrary delivery/farmer data and alter query logic against the application database.
|
|---|
| La source | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/4 |
|---|
| Utilisateur | Elymas (UID 98074) |
|---|
| Soumission | 02/10/2026 14:32 (il y a 17 jours) |
|---|
| Modérer | 18/10/2026 18:26 (16 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 421855 [Dav-ee dairy-management-system payment/pay.php mysqli_real_escape_string f_no/farmer injection SQL] |
|---|
| Points | 20 |
|---|