| Titolo | SourceCodester Stock Management System in PHP V1.0 SQL Injection |
|---|
| Descrizione | During the security review of the "Stock Management System," xuanluansec discovered a critical SQL injection vulnerability in the index.php file. This vulnerability stems from inadequate validation of user inputs for the username and password parameters, allowing attackers to inject malicious SQL queries. As a result, attackers can gain unauthorized access to the database, modify or delete data, and access sensitive information. Immediate remediation is required to secure the system and protect data integrity.
A SQL injection vulnerability was found in the index.php file of the Stock Management System project. This issue arises because user inputs $username and $password from $_POST['username'] and $_POST['password'] are directly used in SQL queries without proper sanitization or validation. This allows attackers to craft input values that can manipulate the SQL query and execute unauthorized operations. |
|---|
| Fonte | ⚠️ https://github.com/CveSecLook/cve/issues/43 |
|---|
| Utente | xuanluansec (UID 68581) |
|---|
| Sottomissione | 08/06/2024 06:25 (2 anni fa) |
|---|
| Moderazione | 08/06/2024 09:48 (3 hours later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 267457 [SourceCodester Stock Management System 1.0 Login index.php username/password iniezione SQL] |
|---|
| Punti | 20 |
|---|