| 제목 | phpgurukul.com phpgurukul User Registration & Login and User Management System With admin panel V1.0 SQL Injection Vulnerability |
|---|
| 설명 | PROBLEM TYPE
Vulnerability Type
SQL Injection
Root Cause
A SQL injection vulnerability was found in the "/student_edit1.php" file of the "Student Information System Project In PHP". The reason for this issue is that attackers can inject malicious code from the parameter 'id' after logging in with valid credentials. The application fails to properly sanitize or validate this input before using it in SQL queries. This allows attackers to manipulate SQL queries and perform unauthorized operations.
Impact
Attackers can exploit this SQL injection vulnerability to achieve unauthorized database access, sensitive data leakage, data tampering, comprehensive system control, and even service interruption, posing a serious threat to system security and business continuity.
DESCRIPTION
During the security review of "Student Information System", a critical SQL injection vulnerability was discovered in the "/change-password.phpphp" file. This vulnerability stems from insufficient user input validation of the 'id' parameter. After logging in with valid credentials (username: [[email protected]](mailto:[email protected]) password: 1234), attackers can inject malicious SQL queries through this parameter. Immediate remedial measures are needed to ensure system security and protect data integrity. |
|---|
| 원천 | ⚠️ http://localhost:80/change-password.php |
|---|
| 사용자 | Mountain Ghost (UID 92943) |
|---|
| 제출 | 2026. 07. 13. PM 02:27 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 29. AM 08:53 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397013 [PHPGurukul Student Information System 1.0 /student_edit1.php 아이디 SQL 주입] |
|---|
| 포인트들 | 17 |
|---|