| 제목 | 1000 Projects Beauty Parlour Management System V1.0 SQL Injection |
|---|
| 설명 | The primary root cause is insufficient sanitization of user inputs in the “Array-like #1* ((custom) POST)” parameter. The system constructs SQL statements with these parameters directly, allowing attackers to embed arbitrary code into the query.
Database Compromise
Attackers may escalate privileges, read sensitive data, or make unauthorized modifications.
Data Leakage
Confidential information (e.g., customer details, service logs) could be exposed.
Service Interruption
Malicious queries (like time-based “SLEEP” injections) may degrade system performance or trigger crashes.
System Control
In some scenarios, attackers pivot from database to broader system-level access if combined with other exploits. |
|---|
| 원천 | ⚠️ https://github.com/lings3346/CVE/blob/main/SQL_Injection_in_Beauty_Parlour_Management_System.md |
|---|
| 사용자 | lings3346 (UID 79542) |
|---|
| 제출 | 2024. 12. 30. PM 03:19 (2 연령 ago) |
|---|
| 모더레이션 | 2024. 12. 31. AM 09:46 (18 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 289826 [1000 Projects Beauty Parlour Management System 1.0 Customer Detail add-customer-services.php sids[] SQL 주입] |
|---|
| 포인트들 | 20 |
|---|