| タイトル | SourceCodester Simple Student Attendance System using PHP and MySQL 1.0 SQL Injection |
|---|
| 説明 | The vulnerability exists in the student_form.php file at line 6, where the id parameter is accepted without proper sanitization and validation. This id parameter is subsequently passed to the get_student() function located in actions.class.php at line 127. Due to insufficient input validation, this allows for SQL Injection attacks. Attackers can exploit this vulnerability to execute arbitrary SQL commands, leading to various types of SQL Injection attacks such as boolean-based blind, time-based blind, and UNION queries. Successful exploitation of this vulnerability resulted in unauthorized access to the database, disclosure of sensitive information, modification of data, or even complete compromise of the affected system. |
|---|
| ソース | ⚠️ https://docs.google.com/document/d/1YkKZYuecpT5ZLtwgNBCYA-H-dfOhevYP2C-B4PBZv50/edit?usp=sharing |
|---|
| ユーザー | R0ck3t (UID 70759) |
|---|
| 送信 | 2024年06月18日 19:57 (2 年 ago) |
|---|
| モデレーション | 2024年06月20日 19:25 (2 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 247365 [SourceCodester Simple Student Attendance System 1.0 /modals/student_form.php id SQLインジェクション] |
|---|
| ポイント | 0 |
|---|