| शीर्षक | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection |
|---|
| विवरण | The affected component is the `farmers/` module (`add.php`, `edit.php`, `validate.php`). These files concatenate unsanitized `$_POST` fields (`f_no`, `f_id`, `f_name`, `f_locallity`, `f_ac`, `f_phone`) directly into SQL statements without any escaping or prepared statements. In `farmers/validate.php` the input is used inside `SELECT` queries, and in `farmers/add.php` / `farmers/edit.php` it is used inside `INSERT` / `UPDATE` statements:
```php
// farmers/validate.php
$idresult = mysqli_query($conn,"select * from farmers where f_id= '$f_id' ") or die("unable to fetch records" . mysqli_error($conn));
$noresult = mysqli_query($conn,"select * from farmers where f_no= '$f_no' ") or die("unable to fetch records" . mysqli_error($conn));
```
```php
// farmers/add.php
$sql = "INSERT INTO `farmers` ( `f_no` ,`f_id` , `f_name` , `f_locallity` , `f_ac` , `f_phone` ) VALUES( '{$_POST['f_no']}' ,'{$_POST['f_id']}' , '{$_POST['f_name']}' , '{$_POST['f_locallity']}' , '{$_POST['f_ac']}' , '{$_POST['f_phone']}' ) ";
mysqli_query($conn,$sql) or die(mysqli_error($conn));
```
```php
// farmers/edit.php
$sql = "UPDATE farmers SET f_no = '{$_POST['f_no']}' ,f_id = '{$_POST['f_id']}' , f_name = '{$_POST['f_name']}' , f_locallity = '{$_POST['f_locallity']}' , f_ac = '{$_POST['f_ac']}' , f_phone = '{$_POST['f_phone']}' WHERE f_no = '$f_no' ";
$rslt = mysqli_query($conn,$sql) or die(mysqli_error($conn));
```
Any authenticated user can exploit this because `farmers/add.php` performs no role check (even the lowest-privilege `Clerk` role is allowed). A time-based payload such as `1' OR SLEEP(4) -- -` in `f_id` produced a multi-second delay and a MySQL syntax error, confirming injection. The flaw allows an attacker to read, modify, or delete arbitrary database records (farmers, deliveries, employees), tamper with or reset the administrator password, and fully compromise the application database.
|
|---|
| स्रोत | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/2 |
|---|
| उपयोगकर्ता | 7z2Z (UID 101867) |
|---|
| सबमिशन | 02/10/2026 02:20 PM (17 दिन पहले) |
|---|
| संयम | 18/10/2026 06:25 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 421853 [Dav-ee dairy-management-system farmers/add.php mysqli_query f_no/f_id/f_name/f_locallity/f_ac/f_phone SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|