| शीर्षक | code-projects Barangay Resident Profiling Management System (BRPMS) / Barangay San Fabian 1.0 SQL Injection |
|---|
| विवरण | A SQL injection risk exists in the resident search functionality of BRPMS.
The endpoint receives the search parameter from $_GET, escapes it with real_escape_string(), and then concatenates the escaped value into a SQL fragment:
$search = $_GET['search'] ?? '';
$esc = $conn->real_escape_string($search);
$search_query = " AND (r.first_name LIKE '%$esc%' OR r.last_name LIKE '%$esc%' OR h.purok LIKE '%$esc%')";
That fragment is later embedded directly into the final query:
$sql = "SELECT r.*, h.household_no, h.purok
FROM residents r
JOIN households h ON r.household_id = h.id
WHERE r.is_archived = ? $search_query
ORDER BY r.last_name, r.first_name";
Although real_escape_string() reduces the chance of a trivial quote breakout, this is still unsafe SQL construction. The query should use placeholders for all attacker-controlled values. Relying on escaping is brittle because its correctness depends on connection character set and SQL mode behavior. The database connection in db.php also does not explicitly set the connection character set with set_charset('utf8mb4').
Relevant code:
residents.php, lines 10, 17, 18, and 21-26
db.php, line 13
|
|---|
| स्रोत | ⚠️ https://gist.github.com/c4ttr4ck/504e89cacf12c7d6a87490f3859dfded |
|---|
| उपयोगकर्ता | c4ttr4ck (UID 75518) |
|---|
| सबमिशन | 07/07/2026 10:27 PM (2 महीनों पहले) |
|---|
| संयम | 23/08/2026 08:08 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394526 [code-projects Barangay Resident Profiling Management System 1.0 Resident Search Functionality residents.php खोज SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|