| 제목 | PHPGurukul Blood Donor Management System Using CodeIgniter 1.0 SQL Injection |
|---|
| 설명 | Blood Donor Management System Using CI V1.0 contains an unauthenticated SQL Injection vulnerability in the /admin/Report endpoint. The vulnerability exists because the authentication check in the Report controller constructor is entirely commented out, making the endpoint publicly accessible without login and form validation only checks if fromdate and todate are "required" — no date format or type validation is performed and concatenates raw POST values directly into a SQL string via $this->db->where("date(create_date) between '$fdate' and '$tdate'"). CodeIgniter's Query Builder does not escape raw string arguments to where(), so the entire string is passed to MySQL as-is. An attacker can submit an injection payload in either date field to execute arbitrary SQL queries. |
|---|
| 원천 | ⚠️ https://github.com/usernamevnq/CVEs/issues/2 |
|---|
| 사용자 | n4k3r0 (UID 91985) |
|---|
| 제출 | 2026. 08. 12. AM 10:01 (1 월 ago) |
|---|
| 모더레이션 | 2026. 09. 14. AM 07:03 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 403393 [PHPGurukul Blood Donor Management System 1.0 Report Endpoint Report.php fromdate/todate SQL 주입] |
|---|
| 포인트들 | 20 |
|---|