| 제목 | inventory-management-system v1.0.0 SQL Injection |
|---|
| 설명 | rabindralamsal/inventory-management-system has a SQL Injection leading to Authentication Bypass Vulnerability. The login logic in `index.php` directly concatenates user-controlled `username` and `password` values into SQL statements without parameterized queries or escaping.
The login logic in `index.php` directly concatenates user-controlled `username` and `password` values into SQL statements without parameterized queries or escaping.
Relevant code pattern:
```php
$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM users WHERE username = '$username'";
$result = $connect->query($sql);
$password = md5($password);
$mainSql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$mainResult = $connect->query($mainSql);
```
The `username` parameter is not filtered in this process, resulting in SQL injection vulnerabilities. |
|---|
| 원천 | ⚠️ https://github.com/yingxiujie/cve/issues/8 |
|---|
| 사용자 | yingxiujie (UID 96521) |
|---|
| 제출 | 2026. 07. 20. AM 08:34 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 05. PM 08:44 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399347 [rabindralamsal inventory-management-system 1.0.0 Login index.php username/password SQL 주입] |
|---|
| 포인트들 | 20 |
|---|