| タイトル | itsourcecode St Columban Student Information Management System 1.0 SQL Injection |
|---|
| 説明 | During the security review of "St Columban Student Information Management System" v1.0 (free PHP project distributed by itsourcecode.com), I discovered a critical unauthenticated SQL injection vulnerability in "/admin/login.php" (POST parameter "uname").
The login handler applies only trim() to the username (admin/login.php:50) and interpolates it directly into the authentication query (includes/member.php:35):
SELECT * FROM `useraccounts` WHERE `ACCOUNT_USERNAME`='" . $email . "' and `ACCOUNT_PASSWORD`='" . $h_upass . "' LIMIT 1
The codebase's only escaper (Database::escape_value) is never invoked on this path. Because the password is SHA1-hashed before the query, the injection lives in "uname" and comments out the password predicate; an injected LIMIT 1 satisfies the row_count==1 check (includes/member.php:38).
An unauthenticated remote attacker can therefore bypass authentication and log in as any account, including the seeded Administrator, gaining full control of the application and all student records.
Proof of Concept (verified on a local deployment of the unmodified vendor source):
POST /columbans/admin/login.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
btnlogin=Login&uname='+OR+1=1+LIMIT+1--+ -&pass=x
Result: the session is populated with the first useraccounts row (ACCOUNT_ID=1, Administrator) and the attacker lands on the admin dashboard. A targeted variant also works: ' OR ACCOUNT_TYPE='Administrator' LIMIT 1-- -
Additional observation: the shipped database dump (columbandb.sql) stores unsalted SHA1 password hashes; 6 of 8 seeded accounts share 7110eda4d09e062aa5e4a390b0a572ac0d2c0220 = sha1("1234").
Full evidence (HTTP transcripts, authenticated dashboard screenshots, Docker reproduction environment): see the advisory link. |
|---|
| ユーザー | chaos4 (UID 100466) |
|---|
| 送信 | 2026年08月09日 18:11 (2 月 ago) |
|---|
| モデレーション | 2026年09月13日 15:48 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 322985 [itsourcecode Student Information Management System 1.0 /admin/login.php uname SQLインジェクション] |
|---|
| ポイント | 0 |
|---|