| タイトル | phpgurukul.com phpgurukul User Registration & Login and User Management System With admin panel V1.0 SQL Injection Vulnerability |
|---|
| 説明 | PROBLEM TYPE
Vulnerability Type
SQL Injection
Root Cause
A SQL injection vulnerability was found in the "/student_edit1.php" file of the "Student Information System Project In PHP". The reason for this issue is that attackers can inject malicious code from the parameter 'id' after logging in with valid credentials. The application fails to properly sanitize or validate this input before using it in SQL queries. This allows attackers to manipulate SQL queries and perform unauthorized operations.
Impact
Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, sensitive data leakage, data tampering, comprehensive system control, and even service interruption, posing a serious threat to system security and business continuity.
DESCRIPTION
During the security review of "Student Information System", a critical SQL injection vulnerability was discovered in the "/change-password.phpphp" file. This vulnerability stems from insufficient user input validation of the 'id' parameter. After logging in with valid credentials (username: [[email protected]](mailto:[email protected]) password: 1234), attackers can inject malicious SQL queries through this parameter. Immediate remedial measures are needed to ensure system security and protect data integrity. |
|---|
| ソース | ⚠️ http://localhost:80/change-password.php |
|---|
| ユーザー | Mountain Ghost (UID 92943) |
|---|
| 送信 | 2026年07月13日 14:27 (2 月 ago) |
|---|
| モデレーション | 2026年08月29日 08:53 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 397013 [PHPGurukul Student Information System 1.0 /student_edit1.php 識別子 SQLインジェクション] |
|---|
| ポイント | 17 |
|---|