| शीर्षक | PHPGurukul Daily Expense Tracker System 1.1 SQL Injection |
|---|
| विवरण | The PHPGurukul Daily Expense Tracker System login page contains an unauthenticated SQL Injection vulnerability that allows authentication bypass without valid credentials. The login form accepts an email and password from the user, hashes the password with MD5, and constructs a SQL query by directly concatenating both values into the query string. Because the email parameter is not sanitized or parameterized before insertion into the SQL statement, an attacker can inject SQL operators that bypass the password verification entirely. This grants unauthorized access to the application as any registered user.
|
|---|
| स्रोत | ⚠️ https://github.com/usernamevnq/CVEs/issues/4 |
|---|
| उपयोगकर्ता | n4k3r0 (UID 91985) |
|---|
| सबमिशन | 12/08/2026 11:23 AM (1 महीना पहले) |
|---|
| संयम | 14/09/2026 07:07 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403396 [PHPGurukul Daily Expense Tracker System 1.1 Login /dets/index.php email SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|