| タイトル | SourceCodestere Simple CRUD using PHP and FPDF V1.0 SQL Injection |
|---|
| 説明 | Validation Method
The finding was validated with sqlmap in a local authorized test environment. The sqlmap command and key output are included below so the parameter, injection type, payload, vector, backend DBMS, and any actual enumeration result can be reviewed.
Vulnerable Location
Affected File: app/register.php (line 12)
Vulnerable Parameter: firstname
Affected Endpoint: https://target.example/register.php
HTTP Method: POST
Vulnerability Overview
The Simple CRUD using PHP and FPDF application does not properly validate or sanitize user input for the firstname parameter. This results in a time-based blind SQL injection vulnerability. An attacker needs network access to the application and a valid authenticated user session. An attacker can construct and execute malicious SQL statements through the affected endpoint and backend SQL sink.
Problem Type and Root Cause
Type: SQL Injection
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Root Cause: User-supplied input from the firstname parameter flows into a raw SQL execution path without prepared statements, safe parameter binding, or strict allowlist validation. This allows attacker-controlled input to alter the intended query logic.
Impact
Attack Conditions: Network access to the endpoint and an authenticated authenticated user session are required.
Potential Impact: The verified evidence proves attacker-controlled SQL query alteration and backend DBMS fingerprinting. Depending on the affected query and application privileges, exploitation may support unauthorized data access or modification; final submission impact should remain limited to the collected evidence. |
|---|
| ソース | ⚠️ https://github.com/cm126261/CVE/issues/2 |
|---|
| ユーザー | Smartiesxum (UID 102012) |
|---|
| 送信 | 2026年10月15日 13:49 (24 日 ago) |
|---|
| モデレーション | 2026年11月08日 17:41 (24 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 432917 [SourceCodester Simple CRUD using PHP and FPDF 1.0 app/register.php firstname SQLインジェクション] |
|---|
| ポイント | 20 |
|---|