| 제목 | sambitraj STUDENT-MANAGEMENT-SYSTEM 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 SQL Injection |
|---|
| 설명 | The affected components are the dashboard lookup and edit-search handlers in admin_dashboard.php, student_dashboard.php, and teacher_dashboard.php. These files concatenate $_POST["roll_no"] and $_POST["teacher_name"] directly into SQL SELECT statements:
$query = "select * from students where roll_no = '$_POST[roll_no]'";
$query_run = mysqli_query($connection,$query);
$query = "select * from teachers where teacher_name = '$_POST[teacher_name]'";
$query_run = mysqli_query($connection,$query);
$query = "select * from results where roll_no = '$_POST[roll_no]'";
$query_run = mysqli_query($connection,$query);
The same pattern exists in admin_dashboard.php lines 213, 306, 501, 586, 766, and 857; student_dashboard.php lines 165, 258, and 343; and teacher_dashboard.php lines 193, 286, 481, 566, and 657. An attacker can inject SQL expressions such as 999' OR SLEEP(2)-- - into dashboard search parameters. This allows blind data extraction, arbitrary record enumeration, and database probing from dashboard request paths. This is distinct from the existing login SQL injection issue because it affects post-login dashboard lookup/edit flows and non-login request parameters. |
|---|
| 원천 | ⚠️ https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/4 |
|---|
| 사용자 | vkk6 (UID 83180) |
|---|
| 제출 | 2026. 07. 06. PM 07:18 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 22. AM 11:04 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394297 [sambitraj Student-Management-System 까지 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Dashboard roll_no/teacher_name SQL 주입] |
|---|
| 포인트들 | 20 |
|---|