| शीर्षक | Fabian Ros Student File Management System in PHP 1.0 (Released 2025-12-03) SQL Injection |
|---|
| विवरण | A critical SQL injection vulnerability exists in the Student File Management System (SFMS) v1.0 within the /admin/delete_user.php file, where the user_id POST parameter is directly concatenated into a DELETE SQL query without proper validation or parameterization, allowing authenticated attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion, and enabling further system compromise through crafted SQL statements that could bypass security controls, with the attack vector requiring administrative access but potentially exploitable in combination with other vulnerabilities such as CSRF to amplify its impact on system integrity and confidentiality. |
|---|
| स्रोत | ⚠️ https://gist.github.com/b1uel0n3/2f9f8284e57d26b54df3d74a095c9971 |
|---|
| उपयोगकर्ता | b1uel0n3 (UID 93016) |
|---|
| सबमिशन | 08/12/2025 02:52 PM (10 महीनों पहले) |
|---|
| संयम | 13/12/2025 10:01 AM (5 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 336378 [code-projects Student File Management System 1.0 /admin/delete_user.php user_id SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|