| Titolo | sambitraj STUDENT-MANAGEMENT-SYSTEM 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 SQL Injection |
|---|
| Descrizione | The affected components are the dashboard lookup and edit-search handlers in admin_dashboard.php, student_dashboard.php, and teacher_dashboard.php. These files concatenate $_POST["roll_no"] and $_POST["teacher_name"] directly into SQL SELECT statements:
$query = "select * from students where roll_no = '$_POST[roll_no]'";
$query_run = mysqli_query($connection,$query);
$query = "select * from teachers where teacher_name = '$_POST[teacher_name]'";
$query_run = mysqli_query($connection,$query);
$query = "select * from results where roll_no = '$_POST[roll_no]'";
$query_run = mysqli_query($connection,$query);
The same pattern exists in admin_dashboard.php lines 213, 306, 501, 586, 766, and 857; student_dashboard.php lines 165, 258, and 343; and teacher_dashboard.php lines 193, 286, 481, 566, and 657. An attacker can inject SQL expressions such as 999' OR SLEEP(2)-- - into dashboard search parameters. This allows blind data extraction, arbitrary record enumeration, and database probing from dashboard request paths. This is distinct from the existing login SQL injection issue because it affects post-login dashboard lookup/edit flows and non-login request parameters. |
|---|
| Fonte | ⚠️ https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/4 |
|---|
| Utente | vkk6 (UID 83180) |
|---|
| Sottomissione | 06/07/2026 19:18 (2 mesi fa) |
|---|
| Moderazione | 22/08/2026 11:04 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 394297 [sambitraj Student-Management-System fino a 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Dashboard roll_no/teacher_name iniezione SQL] |
|---|
| Punti | 20 |
|---|