| शीर्षक | PHPGurukul Directory Management System v2.0 SQL Injection |
|---|
| विवरण | A SQL injection vulnerability exists in PHPGurukul Directory Management System 2.0 within the admin/forget-password.php component. The email and mobilenumber POST parameters are concatenated directly into an SQL query without sufficient validation or parameterized queries.
An unauthenticated remote attacker can manipulate the email parameter to make the password recovery query return a valid administrator record. The application subsequently allows the attacker to access the password reset workflow and set a new administrator password.
Successful exploitation can result in authentication bypass and complete administrator account takeover. |
|---|
| स्रोत | ⚠️ https://github.com/baihu-art/PHPGurukul-Directory-Management-System-Project-V2.0 |
|---|
| उपयोगकर्ता | baihu (UID 88498) |
|---|
| सबमिशन | 24/09/2026 06:02 AM (1 महीना पहले) |
|---|
| संयम | 11/10/2026 07:58 PM (18 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 308997 [PHPGurukul Directory Management System 2.0 forget-password.php email SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|