| タイトル | code-projects College Notes Uploading System 1.0 (Latest Official Source Code) SQL Injection |
|---|
| 説明 | The College Notes Uploading System developed in PHP has a critical SQL injection vulnerability in the login.php file. The login interface obtains user-controllable user and pass parameters through POST requests and directly splices them into SQL query statements.
The program incorrectly calls mysqli_real_escape_string() function but does not assign the escaped return value to variables, resulting in user input still being raw unsanitary data. Unauthenticated remote attackers can construct malicious SQL payloads to exploit this vulnerability, achieve login authentication bypass, arbitrarily query all database data, obtain user account plaintext passwords and other sensitive information, and cause serious information leakage and system security risks. |
|---|
| ソース | ⚠️ https://github.com/XOB-Kongqi/SystemCng-SQL-Injection/blob/master/cng_sql.md |
|---|
| ユーザー | XOBKONGQI (UID 98315) |
|---|
| 送信 | 2026年05月16日 19:51 (5 月 ago) |
|---|
| モデレーション | 2026年06月04日 07:44 (18 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 338585 [code-projects College Notes Uploading System 1.0 /login.php user SQLインジェクション] |
|---|
| ポイント | 0 |
|---|