제출 #846331: code-projects Interview Management 1.0 SQL Injection + Missing Authentication

A SQL Injection vulnerability combined with a missing authentication check was discovered in the deletion functionality of Interview Management System in PHP version 1.0.

Missing Authentication: The file delete.php does not include any session verification before processing requests. While other pages in the application check for a valid login session, delete.php directly instantiates the Delete class and acts on GET parameters without requiring authentication:

<?php
include ("inc/classes/Delete.php");
$delete = new Delete();

if (isset($_GET['action']) and $_GET['action'] == 'questiondelete') {
$delete->deleteQuestion();
}
if (isset($_GET['action']) and $_GET['action'] == 'deletecand') {
$delete->deleteCandidate();
}
?>

SQL Injection: Inside the Delete class, the GET parameter id is directly concatenated into DELETE queries. Although the application uses PDO, the variable is already interpolated into the query string before prepare() is called, making the prepared statement ineffective as a protection mechanism:

public function deleteQuestion(){
$question_id = $_GET['id'];

$sql = "DELETE FROM reports WHERE question_id = $question_id";
$query = $this->db->simplequerywithoutcondition($sql);

$sql = "DELETE FROM questions WHERE question_id = $question_id";
$query = $this->db->simplequerywithoutcondition($sql);
}

public function deleteCandidate(){
$cand_id = $_GET['id'];

$sql = "DELETE FROM reports WHERE cand_id = $cand_id";
$sql = "DELETE FROM comments WHERE cand_id = $cand_id";
$sql = "DELETE FROM candidates WHERE cand_id = $cand_id";
}

An unauthenticated attacker can inject into the id parameter to delete all records in the reports, questions, candidates, and comments tables.

• 원천: ⚠️ https://gist.github.com/c4ttr4ck/6270bf630365b64d35a0acc48cbf5b12
• 사용자: c4ttr4ck (UID 75518)
• 제출: 2026. 06. 02. PM 08:19 (1 월 ago)
• 모더레이션: 2026. 07. 03. PM 08:33 (1 month later)
• 상태: 중복
• VulDB 항목: 208135 [janobe Interview Management System 1.0 delete.php?action=questiondelete 아이디 SQL 주입]
• 포인트들: 0