| शीर्षक | code-projects Online Job Portal System V1.0 SQL Injection |
|---|
| विवरण | During a security review of "Online Job Portal System", a UNION-based SQL injection vulnerability was discovered in /Admin/EditUser.php. The UserId GET parameter is injected directly into a SELECT query with no sanitization. The query result is rendered into editable HTML form fields, making injected column values immediately visible and extractable via standard HTTP responses. This endpoint requires no authentication, and when combined with the other SQL injection vulnerabilities in the same project, provides the most straightforward path to full database extraction and credential theft, including plaintext administrator passwords. |
|---|
| स्रोत | ⚠️ https://github.com/shihuizhang-dazhi/MY-CVE/issues/3 |
|---|
| उपयोगकर्ता | dazhi (UID 87857) |
|---|
| सबमिशन | 11/06/2026 12:30 PM (1 महीना पहले) |
|---|
| संयम | 13/07/2026 11:19 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 378165 [code-projects Online Job Portal 1.0 /Admin/EditUser.php UserId SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|