| शीर्षक | Student-Management-System imranrisal-dev 1/1 SQL Injection |
|---|
| विवरण | Vulnerability Title: SQL Injection in Login Authentication Module
Description:
A SQL injection vulnerability exists in the authentication module of [产品名称], specifically within loginCheckTest.php and the underlying UserModel.php. The application fails to sanitize user-supplied input from the username and password parameters before including them directly into a database query: SELECT * FROM users WHERE username='{$username}' AND password='{$password}'. An unauthenticated attacker can manipulate these parameters to inject malicious SQL syntax. This flaw allows attackers to bypass authentication, extract sensitive data from the users table, or potentially gain unauthorized administrative access. Furthermore, the application stores passwords in plaintext, exacerbating the impact of a potential database compromise. |
|---|
| स्रोत | ⚠️ https://github.com/winterbergnurullah551-sketch/sql-cves/issues/1 |
|---|
| उपयोगकर्ता | HackNine (UID 99046) |
|---|
| सबमिशन | 16/06/2026 03:51 PM (2 महीनों पहले) |
|---|
| संयम | 05/08/2026 04:01 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 386233 [imranrisal-dev Student-Management-System Login loginCheckTest.php username/password SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|