| शीर्षक | bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL 1.0 SQL Injection |
|---|
| विवरण | A SQL Injection vulnerability exists in the `username` parameter of the `admin_transaction.php` file in the Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL application, version <= v1.0.
The application directly incorporates the user-controlled `username` parameter into an SQL query without using prepared statements or sufficient parameterization. As a result, an attacker can provide specially crafted SQL input that alters the intended query structure.
The vulnerability is exploitable as a time-based blind SQL injection. By injecting database expressions that cause a measurable delay when a specified condition is true, an attacker can infer information from the database even when query results are not directly returned in the application's response.
Successful exploitation may allow an unauthenticated or authenticated attacker, depending on access to the affected functionality, to infer database information and potentially access or manipulate data within the privileges available to the application's database account.
The affected source code and reproduction details have been reported to the project maintainer through GitHub Issue #1:
https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/issues/1
|
|---|
| स्रोत | ⚠️ https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/issues/1 |
|---|
| उपयोगकर्ता | Sudais_Nazir (UID 99014) |
|---|
| सबमिशन | 20/09/2026 10:56 AM (16 दिन पहले) |
|---|
| संयम | 05/10/2026 10:30 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413810 [bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL /admin_transaction.php SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|