| タイトル | phpgurukul.com phpgurukul User Registration & Login and User Management System With admin panel V1.0 SQL Injection Vulnerability |
|---|
| 説明 | Problem Type
Vulnerability Type
SQL Injection Root Cause
A SQL injection vulnerability was discovered in the "/student_edit1.php" file within the "phpgurukul User Registration & Login and User Management System With admin panel" project. The reason for this issue is that after the attacker logs in with valid credentials, they can inject malicious code into the parameter "id". The application fails to properly escape or validate this input before using it in the SQL query. This allows the attacker to modify the SQL query and perform unauthorized operations. Impact
Attackers can take advantage of this SQL injection vulnerability to achieve unauthorized database access, leakage of sensitive data, data tampering, full system control, and even service interruption, posing a serious threat to system security and business continuity.
Description
During the security review of "phpgurukul User Registration & Login and User Management System With admin panel", a critical SQL injection vulnerability was identified. This vulnerability exists in the "/change-password.php" file. The vulnerability arises from insufficient validation of the 'id' parameter by the user. After an attacker logs in using valid login credentials, they can inject malicious SQL queries through this parameter. Immediate remedial measures must be taken to ensure system security and protect data integrity. |
|---|
| ソース | ⚠️ https://github.com/Bai-public/CVE/issues/8 |
|---|
| ユーザー | Mountain Ghost (UID 92943) |
|---|
| 送信 | 2026年07月13日 14:30 (2 月 ago) |
|---|
| モデレーション | 2026年08月29日 08:53 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 397013 [PHPGurukul Student Information System 1.0 /student_edit1.php 識別子 SQLインジェクション] |
|---|
| ポイント | 0 |
|---|