| शीर्षक | Abdurrab5 (Github) Online Makeup Store 1.0 Unauthenticated SQL Injection (Authentication Bypass) |
|---|
| विवरण | The customer login handler in customerSignin.php concatenates the username and password POST parameters directly into a SQL query with no prepared statement, escaping, or validation:
$aid=$_POST['username'];
$password=$_POST['password'];
$query="SELECT * FROM customer WHERE username='$aid' and password='$password' ";
$result= mysqli_query($link, $query);
if(mysqli_num_rows($result)){
// ... login succeeds, customer session is set
}
Supplying ' OR '1'='1' -- in username makes the query always true and comments out the password check, logging the attacker in as the first customer with no valid credentials. The same query is also usable for UNION/error-based data extraction. |
|---|
| स्रोत | ⚠️ https://github.com/yashkeral/cve-writeups/blob/main/online-makeup-store/02-customer-login-sqli.md |
|---|
| उपयोगकर्ता | Yashkumar Keral (UID 99903) |
|---|
| सबमिशन | 21/07/2026 08:21 PM (2 महीनों पहले) |
|---|
| संयम | 23/09/2026 03:47 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408968 [Abdurrab5 online-makeup-store Customer Login customerSignin.php username/password SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|