| शीर्षक | SourceCodester AC Repair and Services System v1.0 SQL Injection |
|---|
| विवरण | A SQL Injection vulnerability has been identified in the php-acrss application within the delete_service function. The vulnerable code directly interpolates user-controlled input into an SQL query without proper validation or parameterization. This flaw allows an authenticated—and in some configurations unauthenticated—attacker to manipulate the underlying database.
File: php-acrss/classes/Master.php
Function: delete_service
Line: 108
The delete_service function constructs an SQL query by concatenating the $id parameter directly into the statement:
$del = $this->conn->query("DELETE FROM service_list where id = '{$id}'");
Because the input is neither sanitized nor validated, a malicious user can inject arbitrary SQL payloads via the id parameter. This can lead to unauthorized deletion of database records or execution of additional SQL commands depending on the database permissions. |
|---|
| स्रोत | ⚠️ https://github.com/regrews/cve-vulnerabilities/issues/2 |
|---|
| उपयोगकर्ता | regrews (UID 92696) |
|---|
| सबमिशन | 17/11/2025 02:49 PM (11 महीनों पहले) |
|---|
| संयम | 22/11/2025 05:56 PM (5 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 228798 [SourceCodester AC Repair and Services System 1.0 Master.php?f=delete_service id SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|