| शीर्षक | z-9527 admin ≤ commit 72aaf2d SQL Injection |
|---|
| विवरण | A SQL injection vulnerability exists in Z-9527 Admin ≤ commit 72aaf2d at the /user/login endpoint, where the username field in the request body is concatenated directly into a SQL statement without sanitization or parameterization. As a result, unauthenticated attackers can bypass the password check, obtain a valid authentication response (JWT), and immediately assume the targeted account's identity. This can lead to account takeover, data exposure, and potential full system compromise. Mitigations include using parameterized queries or prepared statements instead of string concatenation, enforcing strict server-side input validation and escaping, storing and verifying passwords with strong hashing algorithms (e.g., bcrypt or argon2), applying least-privilege to database accounts, deploying WAF rules to detect common SQLi patterns, and conducting a comprehensive security audit of all database query construction across the codebase. |
|---|
| स्रोत | ⚠️ https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-3 |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 14/02/2026 02:48 PM (8 महीनों पहले) |
|---|
| संयम | 25/02/2026 03:04 PM (11 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 347772 [z-9527 admin 1.0/2.0 user.js checkName/register/login/getUser/getUsers SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|