| タイトル | Abdullah-Hasan-Sajjad/Online-School web 10/13 SQL Injection |
|---|
| 説明 | This project has SQL injection vulnerabilities. After downloading the project to the local machine and deploying it successfully, it was found that almost all files handling database operations have the following issue:
The code extensively uses string concatenation to construct SQL queries, without implementing parameterized queries or input validation. When accessing the student login interface, an attacker can log in directly using a "universal password". Therefore, this project is vulnerable to SQL injection. |
|---|
| ソース | ⚠️ https://github.com/DaoYunXinShang/Reports/blob/main/sql%20injection.doc |
|---|
| ユーザー | daoyunxinshang (UID 91589) |
|---|
| 送信 | 2025年10月13日 14:03 (12 月 ago) |
|---|
| モデレーション | 2025年10月26日 17:10 (13 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 329948 [Abdullah-Hasan-Sajjad Online-School 迄 f09dda77b4c29aa083ff57f4b1eb991b98b68883 /studentLogin.php Email SQLインジェクション] |
|---|
| ポイント | 20 |
|---|