| 제목 | code-projects Interview Management System in PHP 1.0 SQL Injection |
|---|
| 설명 | A SQL Injection vulnerability exists in the question editing functionality of Interview Management System in PHP version 1.0.
The endpoint editQuestion.php retrieves the question to edit and processes an update through two methods in the application's class layer. In both cases, the GET parameter id is directly concatenated into the SQL query string before being passed to PDO's prepare(). Since PDO only prevents injection when placeholders (?) are used — not when variables are pre-embedded in the query string — the use of prepare() here provides no protection:
In View::viewEditQuestions() (inc/classes/View.php):
function viewEditQuestions(){
$questionId = $_GET['id'];
$sql = "select * from questions where question_id = $questionId";
$query = $this->db->simplequerywithoutcondition($sql);
In Create::editQuestion() (inc/classes/Create.php):
public function editQuestion($data){
$questionId = $_GET['id'];
$sql = "update questions set question = ? where question_id = $questionId";
$arr = array($question);
$results = $this->db->simplequery($sql, $arr);
Both queries execute immediately with the injected id value. The SELECT is exploitable for data extraction; the UPDATE allows modification of any question record by manipulating the WHERE clause. |
|---|
| 원천 | ⚠️ https://gist.github.com/c4ttr4ck/dfddf8167cfd8170def2578b3b6831af |
|---|
| 사용자 | c4ttr4ck (UID 75518) |
|---|
| 제출 | 2026. 06. 02. PM 08:20 (1 월 ago) |
|---|
| 모더레이션 | 2026. 07. 03. PM 08:33 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 208134 [janobe Interview Management System 1.0 editQuestion.php 아이디 SQL 주입] |
|---|
| 포인트들 | 0 |
|---|