| शीर्षक | code-projects Online Job Portal System 1.0 SQL Injection |
|---|
| विवरण | During a security review of "Online Job Portal System", critical SQL injection vulnerabilities combined with missing authorization checks were discovered across 6 administrative and employer management endpoint files. These files accept GET parameters from any unauthenticated visitor and execute arbitrary SQL operations against the database. The absence of session-based authentication checks makes these endpoints a particularly dangerous attack vector, as any anonymous internet user can delete administrators, approve employers, view private job seeker data, and manipulate news and job records through simple URL parameters. |
|---|
| स्रोत | ⚠️ https://github.com/shihuizhang-dazhi/MY-CVE/issues/4 |
|---|
| उपयोगकर्ता | dazhi (UID 87857) |
|---|
| सबमिशन | 11/06/2026 12:53 PM (1 महीना पहले) |
|---|
| संयम | 13/07/2026 11:19 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 378166 [code-projects Online Job Portal तक 1.0 /Admin/DeleteUser.php SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|