| タイトル | PHPGurukul Directory Management System v2.0 SQL Injection |
|---|
| 説明 | A SQL injection vulnerability exists in PHPGurukul Directory Management System 2.0 within the admin/forget-password.php component. The email and mobilenumber POST parameters are concatenated directly into an SQL query without sufficient validation or parameterized queries.
An unauthenticated remote attacker can manipulate the email parameter to make the password recovery query return a valid administrator record. The application subsequently allows the attacker to access the password reset workflow and set a new administrator password.
Successful exploitation can result in authentication bypass and complete administrator account takeover. |
|---|
| ソース | ⚠️ https://github.com/baihu-art/PHPGurukul-Directory-Management-System-Project-V2.0 |
|---|
| ユーザー | baihu (UID 88498) |
|---|
| 送信 | 2026年09月24日 06:02 (1 月 ago) |
|---|
| モデレーション | 2026年10月11日 19:58 (18 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 308997 [PHPGurukul Directory Management System 2.0 forget-password.php email SQLインジェクション] |
|---|
| ポイント | 0 |
|---|