| शीर्षक | SourceCodester Online Student File Management System 1.0 SQL Injection |
|---|
| विवरण | During the security review of the "Online Student File Management System", I discovered a critical SQL injection vulnerability within the file inclusion chain: /admin/index.php → /admin/login.php → /admin/login_query.php. Specifically, when users access /admin/index.php, it includes /admin/login.php to display the login form, and /admin/login.php subsequently includes /admin/login_query.php to handle the login logic. In line 9 of /admin/login_query.php, the username parameter is directly inserted into the SQL query: "SELECT * FROM user WHERE username = '$username' && password = '$password'" without any input validation or parameterized query implementation. This insecure coding practice allows attackers to inject malicious SQL code through the username parameter, potentially gaining unauthorized database access, modifying or deleting data, and accessing sensitive information. Immediate remedial measures are required to ensure system security and protect data integrity.
|
|---|
| स्रोत | ⚠️ https://github.com/qcycop0101-hash/CVE/issues/11 |
|---|
| उपयोगकर्ता | quchunyi2 (UID 89807) |
|---|
| सबमिशन | 05/09/2025 02:45 PM (1 वर्ष पहले) |
|---|
| संयम | 15/09/2025 04:01 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 323917 [SourceCodester Online Student File Management System 1.0 /admin/index.php username SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|