| शीर्षक | itsourcecode itsourcecode Electronic Judging System Project V1.0 V1.0 SQL Injection |
|---|
| विवरण | During the security review of "BCC Intrams Electronic Judging System", I discovered a critical SQL injection and missing authentication vulnerability in the file. This file contains only 9 lines of PHP code yet harbors three fatal defects: no session verification, direct user input concatenation into SQL, and silently suppressing all errors. An attacker only needs to enter a carefully crafted URL in the browser address bar to delete all records in the table within seconds. This vulnerability can be fully automated for mass exploitation, produces no server-side error logs during the attack, and the frontend still displays the misleading "Judge successfully removed" alert. Immediate remedial measures are needed to ensure system security and protect competition data integrity./admin/delete_judge.phperror_reporting(0)judges
Attackers can exploit this vulnerability to delete all judge records from the table with a single HTTP GET request without any authentication, leading to:judges
Complete data integrity loss: All judge information is irreversibly destroyed
Business continuity disruption: The scoring system becomes inoperable, forcing event cancellation
Competition fairness compromised: Selective deletion of judges can manipulate competition results |
|---|
| स्रोत | ⚠️ https://github.com/i-QvQ-i/first-OvO/issues/8 |
|---|
| उपयोगकर्ता | i-OvO-i (UID 97659) |
|---|
| सबमिशन | 05/07/2026 05:32 PM (3 महीनों पहले) |
|---|
| संयम | 20/08/2026 10:43 AM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 365547 [itsourcecode Electronic Judging System 1.0 /admin/delete_judge.php judge_id SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|