| タイトル | sourcecodester Petrol pump management software 1.0 SQL Injection |
|---|
| 説明 | The Petrol Pump Management Software developed by SOURCECODESTER contains a critical SQL Injection vulnerability within its /admin/app/login_crud.php component. This vulnerability arises due to the application's failure to properly sanitize user inputs for the email field in the login process. Attackers can exploit this flaw by crafting malicious SQL queries, which are executed by the server without proper validation. The provided proof of concept demonstrates an attack where an SQL UNION SELECT query is injected through the email parameter, effectively bypassing authentication mechanisms to gain unauthorized access or manipulate the application's data. This particular vulnerability underscores the importance of employing prepared statements or parameterized queries in handling user inputs, thus mitigating the risks associated with SQL Injection attacks, which can lead to unauthorized access, data leaks, and potentially compromising the entire database system. |
|---|
| ソース | ⚠️ https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/login_crud.php%20SQL%20Injection.md |
|---|
| ユーザー | nochizplz (UID 64302) |
|---|
| 送信 | 2024年02月29日 04:53 (3 年 ago) |
|---|
| モデレーション | 2024年03月01日 07:54 (1 day later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 255375 [SourceCodester Petrol Pump Management Software 1.0 login_crud.php email SQLインジェクション] |
|---|
| ポイント | 20 |
|---|