| 제목 | code-projects Student Crud Operation In PHP V3.3 SQL Injection |
|---|
| 설명 | Unauthenticated SQL Injection in delete.php. The GET parameter “id” is concatenated into a DELETE statement without validation or parameterization, allowing mass deletion of rows in card_activation by visiting: {BASE_URL}/Student-Registration-Crud-Operation/delete.php?id=1%20OR%201%3D1%20--%20.
Impact: severe integrity/availability loss. CWE-89.
CVSS v3.1 (estimate): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Fix: use prepared statements (mysqli->prepare + bind_param("i", id)), validate id as integer, require authentication/authorization.
project link： https://code-projects.org/student-crud-operation-in-php-with-source-code/ 1
source code download link： https://download.code-projects.org/details/c4836779-1828-4e2b-95c2-e027096314c6 |
|---|
| 원천 | ⚠️ https://github.com/romatdibrohiksnov/vulndb.com/blob/main/Student%20Crud%20Operation%20In%20PHP%20Unauthenticated%20SQL%20Injection%20allows%20mass%20deletion%20in%20delete.php.md |
|---|
| 사용자 | px_kanten (UID 90960) |
|---|
| 제출 | 2025. 09. 29. AM 08:13 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 10. 06. AM 08:08 (7 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 327228 [code-projects Student Crud Operation 3.3 delete.php id SQL 주입] |
|---|
| 포인트들 | 20 |
|---|