| शीर्षक | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection |
|---|
| विवरण | The affected components are `student_signup.php` and `teacher_signup.php` (repository root). Both files read the registration form values and interpolate them into a SELECT that is supposed to verify that the registering user already exists, and then into an UPDATE that (re)sets the password of the matched row:
```php
// student_signup.php
$query = mysql_query("select * from student where username='$username' and firstname='$firstname' and lastname='$lastname' and class_id = '$class_id'")or die(mysql_error());
$id = $row['student_id'];
if ($count > 0){
mysql_query("update student set password = '$password', status = 'Registered' where student_id = '$id'")or die(mysql_error());
$_SESSION['id']=$id;
echo 'true';
}
```
```php
// teacher_signup.php
$query = mysql_query("select * from teacher where firstname='$firstname' and lastname='$lastname' and department_id = '$department_id'")or die(mysql_error());
$id = $row['teacher_id'];
if ($count > 0){
mysql_query("update teacher set username='$username',password = '$password', teacher_status = 'Registered' where teacher_id = '$id'")or die(mysql_error());
$_SESSION['id']=$id;
echo 'true';
}
```
Injecting `' OR 1=1 -- -` into `firstname` makes the SELECT match an arbitrary existing row; the UPDATE then overwrites that account's password (and for teachers also the username) with the attacker's chosen values. Because these endpoints require no authentication and no CSRF token, an anonymous attacker can take over any student or teacher account whose row can be matched, then log in normally with the new password. The write primitive also allows mass password resets (for example `' OR '1'='1`) across the whole table.
|
|---|
| स्रोत | ⚠️ https://github.com/KusalkaSilva/Learning-Management-System/issues/3 |
|---|
| उपयोगकर्ता | vuldb2026 (UID 101467) |
|---|
| सबमिशन | 20/09/2026 05:22 PM (17 दिन पहले) |
|---|
| संयम | 06/10/2026 07:49 AM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413894 [Kusalkasilva Learning-Management-System तक ffeb873f8803f1e9664384ff75000c7da45466d2 Student Registration Endpoint student_signup.php SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|