| शीर्षक | github Cafe Management System (CafeManagement) - Neethuharii 1.0 Unauthenticated SQL Injection leading to Authentication Bypass |
|---|
| विवरण | The login handler CafePortalLogin.php builds its SQL query by directly concatenating the user-supplied uname (POST) parameter, with no prepared statement, escaping, or input validation:
$username = $_POST[‘uname’]; // raw, unsanitized
…
$sql = “SELECT * FROM register WHERE Username=’$username’”; // string concatenation
$result = mysqli_query($connection, $sql);
if (mysqli_num_rows($result) == 0) { $invalid_error = “Username does not exist”; }
else { $row = mysqli_fetch_assoc($result);
if ($row[‘Password’] == $password) { /* login success */ } }
The uname parameter is injectable. Because the fetched row’s Password column is later compared in PHP against the attacker-supplied password, a UNION SELECT allows the attacker to forge the password value and authenticate as any user — a full authentication bypass. The same flaw also permits full database extraction. |
|---|
| स्रोत | ⚠️ https://medium.com/@mr.yk404/unauthenticated-sql-injection-leading-to-authentication-bypass-in-cafemanagement-php-e64abc2f52da |
|---|
| उपयोगकर्ता | Yashkumar Keral (UID 99903) |
|---|
| सबमिशन | 20/07/2026 05:57 PM (2 महीनों पहले) |
|---|
| संयम | 23/09/2026 12:50 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408920 [Neethuharii CafeManagement Login CafePortalLogin.php uname SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|