| Titolo | satya-vinay Events-Management-System 437c77ceb69bf9fe2e3f4f46f7871b83f425383a SQL Injection |
|---|
| Descrizione | The affected component is `doedit.php` (site root), the unauthenticated registration-edit handler. All eight `$_REQUEST` parameters are concatenated directly into an `UPDATE` statement without escaping, and the page enforces no authentication:
```php
$id=$_REQUEST['id'];
$name=$_REQUEST['name'];
...
$query=mysqli_query($db_connect," UPDATE symbols SET name='$name',title='$title',year='$year',gender='$gender',fromdate='$fromdate',todate='$todate',people='$people' WHERE id='$id' ");
```
An injected comment (`#`) terminates the statement early and removes the `WHERE id=...` restriction, turning a single-row edit into a mass UPDATE of the entire table. Verified: injecting `title=(SELECT SLEEP(3))` into the `name` field delayed the response by 18 seconds (6 stored rows × 3 seconds), and the injected subquery result was written into the `title` column of every row.
|
|---|
| Fonte | ⚠️ https://github.com/satya-vinay/Events-Management-System/issues/2 |
|---|
| Utente | xbjds (UID 101126) |
|---|
| Sottomissione | 04/10/2026 17:46 (22 giorni fa) |
|---|
| Moderazione | 19/10/2026 07:22 (15 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 422246 [satya-vinay Events-Management-System fino a 437c77ceb69bf9fe2e3f4f46f7871b83f425383a Registration-Edit doedit.php mysqli_query id/name/title/year/gender/fromdate/todate/people iniezione SQL] |
|---|
| Punti | 20 |
|---|