| शीर्षक | sambitraj STUDENT-MANAGEMENT-SYSTEM 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Cleartext Storage of Sensitive Information |
|---|
| विवरण | The affected components are the bundled database schema `aca.zip!/aca.sql`, the login handlers, and dashboard views. The database stores passwords directly in `password` columns, login code compares those stored values to POSTed passwords, and dashboards render password values back into HTML:
```sql
`password` varchar(20) NOT NULL
('admin', '[email protected]', 'admin123');
```
```php
if($row['password'] == $_POST['password']){
$_SESSION['email'] = $row['email'];
}
<input type="password" id="btn1" value="<?php echo $row['password']?>" disabled>
```
Because passwords are recoverable database values and are displayed in dashboard HTML, any SQL injection, dashboard access, or IDOR issue can disclose reusable account credentials. The vulnerability affects admin, student, and teacher password handling. |
|---|
| स्रोत | ⚠️ https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/9 |
|---|
| उपयोगकर्ता | iron basin (UID 99905) |
|---|
| सबमिशन | 17/07/2026 07:34 PM (1 महीना पहले) |
|---|
| संयम | 30/08/2026 07:56 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397187 [sambitraj Student Management System तक 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Password aca.sql पासवर्ड कमजोर एन्क्रिप्शन] |
|---|
| अंक | 20 |
|---|