| 제목 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection |
|---|
| 설명 | The affected component is the `farmers/` module (`add.php`, `edit.php`, `validate.php`). These files concatenate unsanitized `$_POST` fields (`f_no`, `f_id`, `f_name`, `f_locallity`, `f_ac`, `f_phone`) directly into SQL statements without any escaping or prepared statements. In `farmers/validate.php` the input is used inside `SELECT` queries, and in `farmers/add.php` / `farmers/edit.php` it is used inside `INSERT` / `UPDATE` statements:
```php
// farmers/validate.php
$idresult = mysqli_query($conn,"select * from farmers where f_id= '$f_id' ") or die("unable to fetch records" . mysqli_error($conn));
$noresult = mysqli_query($conn,"select * from farmers where f_no= '$f_no' ") or die("unable to fetch records" . mysqli_error($conn));
```
```php
// farmers/add.php
$sql = "INSERT INTO `farmers` ( `f_no` ,`f_id` , `f_name` , `f_locallity` , `f_ac` , `f_phone` ) VALUES( '{$_POST['f_no']}' ,'{$_POST['f_id']}' , '{$_POST['f_name']}' , '{$_POST['f_locallity']}' , '{$_POST['f_ac']}' , '{$_POST['f_phone']}' ) ";
mysqli_query($conn,$sql) or die(mysqli_error($conn));
```
```php
// farmers/edit.php
$sql = "UPDATE farmers SET f_no = '{$_POST['f_no']}' ,f_id = '{$_POST['f_id']}' , f_name = '{$_POST['f_name']}' , f_locallity = '{$_POST['f_locallity']}' , f_ac = '{$_POST['f_ac']}' , f_phone = '{$_POST['f_phone']}' WHERE f_no = '$f_no' ";
$rslt = mysqli_query($conn,$sql) or die(mysqli_error($conn));
```
Any authenticated user can exploit this because `farmers/add.php` performs no role check (even the lowest-privilege `Clerk` role is allowed). A time-based payload such as `1' OR SLEEP(4) -- -` in `f_id` produced a multi-second delay and a MySQL syntax error, confirming injection. The flaw allows an attacker to read, modify, or delete arbitrary database records (farmers, deliveries, employees), tamper with or reset the administrator password, and fully compromise the application database.
|
|---|
| 원천 | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/2 |
|---|
| 사용자 | 7z2Z (UID 101867) |
|---|
| 제출 | 2026. 10. 02. PM 02:20 (16 날 ago) |
|---|
| 모더레이션 | 2026. 10. 18. PM 06:25 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 421853 [Dav-ee dairy-management-system farmers/add.php mysqli_query f_no/f_id/f_name/f_locallity/f_ac/f_phone SQL 주입] |
|---|
| 포인트들 | 20 |
|---|