| タイトル | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection |
|---|
| 説明 | The affected component is the `farmers/` module (`add.php`, `edit.php`, `validate.php`). These files concatenate unsanitized `$_POST` fields (`f_no`, `f_id`, `f_name`, `f_locallity`, `f_ac`, `f_phone`) directly into SQL statements without any escaping or prepared statements. In `farmers/validate.php` the input is used inside `SELECT` queries, and in `farmers/add.php` / `farmers/edit.php` it is used inside `INSERT` / `UPDATE` statements:
```php
// farmers/validate.php
$idresult = mysqli_query($conn,"select * from farmers where f_id= '$f_id' ") or die("unable to fetch records" . mysqli_error($conn));
$noresult = mysqli_query($conn,"select * from farmers where f_no= '$f_no' ") or die("unable to fetch records" . mysqli_error($conn));
```
```php
// farmers/add.php
$sql = "INSERT INTO `farmers` ( `f_no` ,`f_id` , `f_name` , `f_locallity` , `f_ac` , `f_phone` ) VALUES( '{$_POST['f_no']}' ,'{$_POST['f_id']}' , '{$_POST['f_name']}' , '{$_POST['f_locallity']}' , '{$_POST['f_ac']}' , '{$_POST['f_phone']}' ) ";
mysqli_query($conn,$sql) or die(mysqli_error($conn));
```
```php
// farmers/edit.php
$sql = "UPDATE farmers SET f_no = '{$_POST['f_no']}' ,f_id = '{$_POST['f_id']}' , f_name = '{$_POST['f_name']}' , f_locallity = '{$_POST['f_locallity']}' , f_ac = '{$_POST['f_ac']}' , f_phone = '{$_POST['f_phone']}' WHERE f_no = '$f_no' ";
$rslt = mysqli_query($conn,$sql) or die(mysqli_error($conn));
```
Any authenticated user can exploit this because `farmers/add.php` performs no role check (even the lowest-privilege `Clerk` role is allowed). A time-based payload such as `1' OR SLEEP(4) -- -` in `f_id` produced a multi-second delay and a MySQL syntax error, confirming injection. The flaw allows an attacker to read, modify, or delete arbitrary database records (farmers, deliveries, employees), tamper with or reset the administrator password, and fully compromise the application database.
|
|---|
| ソース | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/2 |
|---|
| ユーザー | 7z2Z (UID 101867) |
|---|
| 送信 | 2026年10月02日 14:20 (17 日 ago) |
|---|
| モデレーション | 2026年10月18日 18:25 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 421853 [Dav-ee dairy-management-system farmers/add.php mysqli_query f_no/f_id/f_name/f_locallity/f_ac/f_phone SQLインジェクション] |
|---|
| ポイント | 20 |
|---|