| शीर्षक | sourcecodester Petrol pump management software 1.0 SQL Injection |
|---|
| विवरण | The Petrol Pump Management Software developed by SOURCECODESTER contains a critical SQL Injection vulnerability within its /admin/app/login_crud.php component. This vulnerability arises due to the application's failure to properly sanitize user inputs for the email field in the login process. Attackers can exploit this flaw by crafting malicious SQL queries, which are executed by the server without proper validation. The provided proof of concept demonstrates an attack where an SQL UNION SELECT query is injected through the email parameter, effectively bypassing authentication mechanisms to gain unauthorized access or manipulate the application's data. This particular vulnerability underscores the importance of employing prepared statements or parameterized queries in handling user inputs, thus mitigating the risks associated with SQL Injection attacks, which can lead to unauthorized access, data leaks, and potentially compromising the entire database system. |
|---|
| स्रोत | ⚠️ https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/login_crud.php%20SQL%20Injection.md |
|---|
| उपयोगकर्ता | nochizplz (UID 64302) |
|---|
| सबमिशन | 29/02/2024 04:53 AM (3 साल पहले) |
|---|
| संयम | 01/03/2024 07:54 AM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 255375 [SourceCodester Petrol Pump Management Software 1.0 login_crud.php email SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|