| タイトル | code-projects Pharmacy Management System 1.0 SQL Injection |
|---|
| 説明 | A **critical SQL injection vulnerability** has been identified in the **Pharmacy Management System** version 1.0, specifically during the **invoice creation process**. The issue lies in how the system retrieves the list of medicines based on a search query passed through the `text` parameter. The input is not properly sanitized, allowing attackers to inject and execute arbitrary SQL commands.
When creating a new invoice, the system queries the medicine database using the `text` parameter to display matching results. However, the lack of input validation makes it vulnerable to SQL injection attacks. Exploiting this flaw could allow unauthorized access to sensitive data, such as medicine inventory details, and even manipulation or deletion of records. This vulnerability is **critical**, as it compromises both the availability and integrity of the system. Immediate remediation is necessary to avoid disruption of pharmaceutical operations and data breaches. |
|---|
| ソース | ⚠️ https://gist.github.com/higordiego/be616d2853a9f1820d8558fc00e97e24 |
|---|
| ユーザー | c4ttr4ck (UID 75518) |
|---|
| 送信 | 2024年10月19日 17:59 (2 年 ago) |
|---|
| モデレーション | 2024年10月20日 20:49 (1 day later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 281021 [code-projects Pharmacy Management System 1.0 /add_new_invoice.php text SQLインジェクション] |
|---|
| ポイント | 20 |
|---|