| शीर्षक | pmTicket Project-Management-Software(https://github.com/issue-tracking-system/Project-Management-Software) commit : cd6e519d507cdd4d63061300bf60fb176e1f57e0 SQL Injection |
|---|
| विवरण | This vulnerability exists in the `setSync` function, which is reachable through the `https://github.com/issue-tracking-system/Project-Management-Software/blob/master/ajax/add_project.php` file. It occurs because arbitrary user input (`$_POST['conn_settings']`) is passed directly to the `setSync` method, where attacker-controlled values such as `hostname` and `username` are concatenated into SQL queries without proper sanitization or parameterized statements. This improper handling of user-supplied input enables an unauthenticated attacker to perform SQL injection, allowing unauthorized database query manipulation and potentially leading to information disclosure, authentication bypass, or further compromise of the application and underlying database.
|
|---|
| स्रोत | ⚠️ https://asciinema.org/a/1230576 |
|---|
| उपयोगकर्ता | Allan Njuguna (UID 57480) |
|---|
| सबमिशन | 24/07/2026 04:47 PM (2 महीनों पहले) |
|---|
| संयम | 23/09/2026 05:52 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409005 [pmTicket Project-Management-Software तक 078fa56a782490c5059a0814f84df27984f4d7e2 /ajax/add_project.php setSync conn_settings SQL इंजेक्शन] |
|---|
| अंक | 19 |
|---|