| शीर्षक | code-projects Pharmacy Management System 1.0 SQL Injection |
|---|
| विवरण | A **critical SQL injection vulnerability** has been identified in the **Pharmacy Management System** version 1.0, specifically during the **invoice creation process**. The issue lies in how the system retrieves the list of medicines based on a search query passed through the `text` parameter. The input is not properly sanitized, allowing attackers to inject and execute arbitrary SQL commands.
When creating a new invoice, the system queries the medicine database using the `text` parameter to display matching results. However, the lack of input validation makes it vulnerable to SQL injection attacks. Exploiting this flaw could allow unauthorized access to sensitive data, such as medicine inventory details, and even manipulation or deletion of records. This vulnerability is **critical**, as it compromises both the availability and integrity of the system. Immediate remediation is necessary to avoid disruption of pharmaceutical operations and data breaches. |
|---|
| स्रोत | ⚠️ https://gist.github.com/higordiego/be616d2853a9f1820d8558fc00e97e24 |
|---|
| उपयोगकर्ता | c4ttr4ck (UID 75518) |
|---|
| सबमिशन | 19/10/2024 05:59 PM (2 साल पहले) |
|---|
| संयम | 20/10/2024 08:49 PM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 281021 [code-projects Pharmacy Management System 1.0 /add_new_invoice.php text SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|