提出 #846331: code-projects Interview Management 1.0 SQL Injection + Missing Authentication

A SQL Injection vulnerability combined with a missing authentication check was discovered in the deletion functionality of Interview Management System in PHP version 1.0.

Missing Authentication: The file delete.php does not include any session verification before processing requests. While other pages in the application check for a valid login session, delete.php directly instantiates the Delete class and acts on GET parameters without requiring authentication:

<?php
include ("inc/classes/Delete.php");
$delete = new Delete();

if (isset($_GET['action']) and $_GET['action'] == 'questiondelete') {
$delete->deleteQuestion();
}
if (isset($_GET['action']) and $_GET['action'] == 'deletecand') {
$delete->deleteCandidate();
}
?>

SQL Injection: Inside the Delete class, the GET parameter id is directly concatenated into DELETE queries. Although the application uses PDO, the variable is already interpolated into the query string before prepare() is called, making the prepared statement ineffective as a protection mechanism:

public function deleteQuestion(){
$question_id = $_GET['id'];

$sql = "DELETE FROM reports WHERE question_id = $question_id";
$query = $this->db->simplequerywithoutcondition($sql);

$sql = "DELETE FROM questions WHERE question_id = $question_id";
$query = $this->db->simplequerywithoutcondition($sql);
}

public function deleteCandidate(){
$cand_id = $_GET['id'];

$sql = "DELETE FROM reports WHERE cand_id = $cand_id";
$sql = "DELETE FROM comments WHERE cand_id = $cand_id";
$sql = "DELETE FROM candidates WHERE cand_id = $cand_id";
}

An unauthenticated attacker can inject into the id parameter to delete all records in the reports, questions, candidates, and comments tables.

• ソース: ⚠️ https://gist.github.com/c4ttr4ck/6270bf630365b64d35a0acc48cbf5b12
• ユーザー: c4ttr4ck (UID 75518)
• 送信: 2026年06月02日 20:19 (1 月 ago)
• モデレーション: 2026年07月03日 20:33 (1 month later)
• ステータス: 重複
• VulDBエントリ: 208135 [janobe Interview Management System 1.0 delete.php?action=questiondelete 識別子 SQLインジェクション]
• ポイント: 0