| शीर्षक | sourcecodester Petrol pump management software 1.0 SQL Injection |
|---|
| विवरण | The Petrol Pump Management Software available on SOURCECODESTER is vulnerable to an Unauthenticated SQL Injection attack through its /admin/edit_supplier.php endpoint. This security flaw is due to the application's improper handling and sanitization of user-supplied input in the id parameter. By exploiting this vulnerability, attackers can craft malicious SQL queries that the application will execute without validation. The provided proof of concept demonstrates how an attacker can use a UNION SELECT query to retrieve sensitive information from the database, such as data from the /etc/passwd file or the database version, by injecting into the id parameter. This type of vulnerability poses a significant risk as it can lead to unauthorized access to sensitive data, database manipulation, or even a complete system compromise. The addition of credits to Russel James Avenido alongside Joshua Lictan suggests a collaborative effort in identifying and reporting this critical vulnerability. It underscores the need for rigorous input validation, the use of prepared statements, and proper authentication mechanisms to protect web applications from SQL Injection attacks. |
|---|
| स्रोत | ⚠️ https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/edit_supplier.php%20SQL%20Injection.md |
|---|
| उपयोगकर्ता | nochizplz (UID 64302) |
|---|
| सबमिशन | 29/02/2024 05:26 AM (3 साल पहले) |
|---|
| संयम | 01/03/2024 07:54 AM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 255376 [SourceCodester Petrol Pump Management Software 1.0 /admin/edit_supplier.php पहचान SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|