| 제목 | tushar-2223 Hotel Management System Latest SQL Injection |
|---|
| 설명 | A critical unauthenticated SQL injection vulnerability was discovered in the Hotel Management System. The id parameter in roomdelete.php and paymantdelete.php is directly concatenated into SQL queries without any input validation, leading to a full authentication bypass and unauthorized database manipulation.
Full technical details and Secret PoC:https://gist.github.com/freeloader9527/a9ab20c922c6aa2b3eabf93e01a40f6b |
|---|
| 원천 | ⚠️ https://github.com/tushar-2223/Hotel-Management-System/issues/15 |
|---|
| 사용자 | wacool (UID 72886) |
|---|
| 제출 | 2026. 04. 02. PM 06:39 (6 개월 ago) |
|---|
| 모더레이션 | 2026. 04. 12. AM 09:51 (10 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 357006 [tushar-2223 Hotel Management System 까지 bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 /admin/roomdelete.php id SQL 주입] |
|---|
| 포인트들 | 20 |
|---|