| शीर्षक | Report_Online-Banking-System web 1.0 SQL Injection |
|---|
| विवरण | Vulnerability Title:SQL Injection in Online Banking System Login Function
Vulnerability Details:
Multiple SQL injection vulnerabilities were identified in the customer and staff login interfaces of the Online Banking System. The vulnerabilities allow unauthenticated attackers to extract sensitive database information including user credentials, database structure, and other confidential data.
Affected Components:
Customer Login Page (/banking/index.php)
Staff Login Page (/banking/staff_login.php)
Proof of Concept:
Navigate to the login page
In username field, enter: 1' AND extractvalue(1,concat(0x7e,database()))--
System returns: XPATH syntax error: '~bnak_db'
Database name bnak_dbis successfully extracted
Impact:
Attackers can completely compromise the database containing customer financial information and administrative credentials.
Environment:
PHP-based web application
MySQL database
Reproducible in standard LAMP/Windows environments |
|---|
| स्रोत | ⚠️ https://github.com/Nianalb/Report_Online-Banking-System/blob/main/SQL.docx |
|---|
| उपयोगकर्ता | Nianalb (UID 91431) |
|---|
| सबमिशन | 06/11/2025 03:29 PM (11 महीनों पहले) |
|---|
| संयम | 16/11/2025 09:24 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 332611 [g33kyrash Online-Banking-System तक 12dbfa690e5af649fb72d2e5d3674e88d6743455 /index.php username SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|