| 제목 | Fabian Ros Student Information System In PHP With Source Code November 2, 2025 SQL Injection |
|---|
| 설명 | A widespread SQL Injection vulnerability pattern exists in the Student Information System (version uploaded on November 2, 2025) which allows remote attackers to execute arbitrary SQL commands via multiple parameters.
The application fails to sanitize user input and does not use parameterized queries across several key endpoints. Specifically:
UNION-based SQLi exists in /searchresults.php via the searchbox parameter, allowing full database exfiltration.
Time-based Blind SQLi exists in /register.php via the username parameter.
Authentication Bypass and Blind SQLi exist in the login function in /index.php via the username and password parameters.
An attacker can leverage these flaws to bypass authentication, extract sensitive records from the database, or manipulate data, posing a critical risk to the confidentiality and integrity of the system. |
|---|
| 원천 | ⚠️ https://github.com/i4G5d/CRITICAL-SEVERITY-VULNERABILITY-REPORT-Widespread-SQLI |
|---|
| 사용자 | i4g5d (UID 92060) |
|---|
| 제출 | 2025. 12. 20. PM 05:17 (4 개월 ago) |
|---|
| 모더레이션 | 2025. 12. 23. PM 03:33 (3 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 337859 [code-projects Student Information System 1.0 /searchresults.php searchbox SQL 주입] |
|---|
| 포인트들 | 20 |
|---|