| शीर्षक | itsourcecode Library Management System 1.0 SQL Injection |
|---|
| विवरण | Description:
Six files use `$_GET['id']` concatenated directly into SQL without sanitization or casting. Affected: `editbooks.php`, `editpublisher.php`, `editstaff.php`, `editstudent.php`, and more.
Vulnerable Code:
**Example - `editbooks.php`, Line 34**:
```php
$id = $_GET['id'];
$query = "SELECT * FROM books WHERE book_id = $id";
$result = mysqli_query($con, $query);
```
Impact:
- Extract all library data via UNION injection
- Modify or delete book, staff, student records
- Six separate attack vectors via GET parameters
Reference: https://github.com/microwaveabi/vul/issues/89 |
|---|
| स्रोत | ⚠️ https://github.com/microwaveabi/vul/issues/89 |
|---|
| उपयोगकर्ता | microwave (UID 96185) |
|---|
| सबमिशन | 11/07/2026 05:15 AM (1 महीना पहले) |
|---|
| संयम | 24/08/2026 12:40 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394577 [itsourcecode Library Management System 1.0 editbooks.php पहचान SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|