| शीर्षक | Abdurrab5 (Github) Online Makeup Store 1.0 Unauthenticated SQL Injection (Authentication Bypass) |
|---|
| विवरण | The admin login handler in index.php concatenates the id and password POST parameters directly into a SQL query, with no prepared statement, escaping, or validation:
$aid=$_POST['id'];
$password=$_POST['password'];
$query="SELECT * FROM admin WHERE id='$aid' and password='$password' ";
$result= mysqli_query($link, $query);
if(mysqli_num_rows($result)){
// ... login succeeds, $_SESSION['adminid'] is set
}
The id parameter is injectable. An attacker can supply ' OR '1'='1' -- to make the WHERE clause always true and comment out the password check, authenticating as an administrator without any credentials. Passwords are stored in plaintext, and the handler also reflects raw mysqli_error() output on failure (information exposure / error-based SQLi). |
|---|
| स्रोत | ⚠️ https://github.com/yashkeral/cve-writeups/blob/main/online-makeup-store/01-admin-login-sqli.md |
|---|
| उपयोगकर्ता | Yashkumar Keral (UID 99903) |
|---|
| सबमिशन | 21/07/2026 08:17 PM (2 महीनों पहले) |
|---|
| संयम | 23/09/2026 03:47 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408967 [Abdurrab5 online-makeup-store Admin Login index.php id/password SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|