| タイトル | code-projects Interview Management System in PHP 1.0 SQL Injection |
|---|
| 説明 | A SQL Injection vulnerability exists in the question editing functionality of Interview Management System in PHP version 1.0.
The endpoint editQuestion.php retrieves the question to edit and processes an update through two methods in the application's class layer. In both cases, the GET parameter id is directly concatenated into the SQL query string before being passed to PDO's prepare(). Since PDO only prevents injection when placeholders (?) are used — not when variables are pre-embedded in the query string — the use of prepare() here provides no protection:
In View::viewEditQuestions() (inc/classes/View.php):
function viewEditQuestions(){
$questionId = $_GET['id'];
$sql = "select * from questions where question_id = $questionId";
$query = $this->db->simplequerywithoutcondition($sql);
In Create::editQuestion() (inc/classes/Create.php):
public function editQuestion($data){
$questionId = $_GET['id'];
$sql = "update questions set question = ? where question_id = $questionId";
$arr = array($question);
$results = $this->db->simplequery($sql, $arr);
Both queries execute immediately with the injected id value. The SELECT is exploitable for data extraction; the UPDATE allows modification of any question record by manipulating the WHERE clause. |
|---|
| ソース | ⚠️ https://gist.github.com/c4ttr4ck/dfddf8167cfd8170def2578b3b6831af |
|---|
| ユーザー | c4ttr4ck (UID 75518) |
|---|
| 送信 | 2026年06月02日 20:20 (1 月 ago) |
|---|
| モデレーション | 2026年07月03日 20:33 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 208134 [janobe Interview Management System 1.0 editQuestion.php 識別子 SQLインジェクション] |
|---|
| ポイント | 0 |
|---|