| 제목 | keerti1924 Online-Book-Store-Website 1.0 Blind SQL Injection |
|---|
| 설명 | The 'shop.php' script in keerti1924's Online-Book-Store-Website is vulnerable to Blind SQL Injection attacks. An attacker could exploit this vulnerability to execute arbitrary SQL queries on the underlying database, potentially leading to unauthorized access to sensitive information or data manipulation. To exploit this flaw, an attacker needs to be logged in as a normal user and inject a specially crafted payload into the 'product_name' parameter of a POST request. By observing delays in the server's response, the attacker can infer the success of the injection. Remediating this issue involves implementing robust input validation and parameterized queries to prevent SQL injection attacks, along with enforcing the principle of least privilege to limit the impact of such vulnerabilities. |
|---|
| 원천 | ⚠️ https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/keerti1924%20Online-Book-Store-Website/Blind%20SQL%20Injection%20%20Shop/Blind%20SQL%20Injection%20Shop.php%20.md |
|---|
| 사용자 | nochizplz (UID 64302) |
|---|
| 제출 | 2024. 02. 26. PM 01:45 (3 연령 ago) |
|---|
| 모더레이션 | 2024. 03. 07. PM 03:35 (10 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 256041 [keerti1924 Online-Book-Store-Website 1.0 HTTP POST Request /shop.php product_name SQL 주입] |
|---|
| 포인트들 | 20 |
|---|