| タイトル | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection |
|---|
| 説明 | The affected components are `payment/pay.php` and `reports/farmer_monthly.php`. These files escape user input with `mysqli_real_escape_string()` but then concatenate it into SQL **without surrounding quotes**, so escaping provides no protection — an attacker can inject operators such as `OR 1=1` or `AND SLEEP(n)` without using any quote character:
```php
// payment/pay.php
$f_no = mysqli_real_escape_string($conn, $_GET['f_no']);
$farmer = mysqli_fetch_array(mysqli_query($conn,"select f_no,f_name,last_paid,f_ac from farmers where f_no=$f_no"));
$result = mysqli_query($conn,"SELECT * FROM `delivery` WHERE r_f_no=$f_no and `r_dt` >='$start' and `r_dt` <= '$end'") or trigger_error(mysqli_error($conn));
```
```php
// reports/farmer_monthly.php
$f_no = mysqli_real_escape_string($conn, $_REQUEST['farmer']);
$result = mysqli_query($conn,"SELECT * FROM `delivery` WHERE r_f_no=$f_no $start $end") or trigger_error(mysqli_error($conn));
```
The endpoints are reachable by any authenticated user (no role restriction). `farmer=0 OR 1=1` in `farmer_monthly.php` returned all delivery rows while `farmer=0` returned none, and `f_no=1 AND SLEEP(3)` in `pay.php` caused a ~12 second delay, confirming injection. The flaw allows an authenticated attacker to read arbitrary delivery/farmer data and alter query logic against the application database.
|
|---|
| ソース | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/4 |
|---|
| ユーザー | Elymas (UID 98074) |
|---|
| 送信 | 2026年10月02日 14:32 (17 日 ago) |
|---|
| モデレーション | 2026年10月18日 18:26 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 421855 [Dav-ee dairy-management-system payment/pay.php mysqli_real_escape_string f_no/farmer SQLインジェクション] |
|---|
| ポイント | 20 |
|---|