| タイトル | sambitraj STUDENT-MANAGEMENT-SYSTEM 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 SQL Injection |
|---|
| 説明 | The affected components are the dashboard lookup and edit-search handlers in admin_dashboard.php, student_dashboard.php, and teacher_dashboard.php. These files concatenate $_POST["roll_no"] and $_POST["teacher_name"] directly into SQL SELECT statements:
$query = "select * from students where roll_no = '$_POST[roll_no]'";
$query_run = mysqli_query($connection,$query);
$query = "select * from teachers where teacher_name = '$_POST[teacher_name]'";
$query_run = mysqli_query($connection,$query);
$query = "select * from results where roll_no = '$_POST[roll_no]'";
$query_run = mysqli_query($connection,$query);
The same pattern exists in admin_dashboard.php lines 213, 306, 501, 586, 766, and 857; student_dashboard.php lines 165, 258, and 343; and teacher_dashboard.php lines 193, 286, 481, 566, and 657. An attacker can inject SQL expressions such as 999' OR SLEEP(2)-- - into dashboard search parameters. This allows blind data extraction, arbitrary record enumeration, and database probing from dashboard request paths. This is distinct from the existing login SQL injection issue because it affects post-login dashboard lookup/edit flows and non-login request parameters. |
|---|
| ソース | ⚠️ https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/4 |
|---|
| ユーザー | vkk6 (UID 83180) |
|---|
| 送信 | 2026年07月06日 19:18 (2 月 ago) |
|---|
| モデレーション | 2026年08月22日 11:04 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 394297 [sambitraj Student-Management-System 迄 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Dashboard roll_no/teacher_name SQLインジェクション] |
|---|
| ポイント | 20 |
|---|