| 제목 | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Information Exposure Through Error Message |
|---|
| 설명 | The affected components are any page that runs `mysqli_*` calls on user input without checking the result. Two concrete examples observed in the lab:
1. `User/ord.php` — when `?id=` does not match a menu row, `mysqli_fetch_array()` is called on `bool` from a failed `mysqli_query`. PHP emits the warning directly into the response, including the absolute server path of the script:
```
<br />
<b>Warning</b>: mysqli_fetch_array() expects parameter 1 to be mysqli_result, bool given in <b>/www/wwwroot/foodcorner/User/ord.php</b> on line <b>13</b><br />
<br />
<b>Warning</b>: A non-numeric value encountered in <b>/www/wwwroot/foodcorner/User/ord.php</b> on line <b>20</b><br />
```
2. `User/ord_t.php` — the same warning fires, and **additionally** the file actively executes `echo $sql;` (not commented out, unlike `User/ord.php`'s `//echo $sql;`). The full INSERT string with the user's inputs is returned to the caller:
```
<br />
<b>Warning</b>: mysqli_fetch_array() expects parameter 1 to be mysqli_result, bool given in <b>/www/wwwroot/foodcorner/User/ord_t.php</b> on line <b>9</b><br />
insert into t_order values('','',,'','',,,'','pending..',)
```
The same pattern appears in many scripts that interpolate user input into SQL strings without first checking that `mysqli_query` returned a valid result — `admin/display_menu.php` (search), `admin/tables.php` (search), `admin/orders.php`, `admin/t_orders.php`, etc. Any malformed input (or any input that triggers the SQL-injection chain) produces a PHP warning that discloses:
- The server's internal path (`/www/wwwroot/foodcorner/User/...`)
- The DB server's interpretation of the input (which gives defenders a free oracle for the SQLi primitives in CVE-04/CVE-05/CVE-06/CVE-07)
The CWE label is **Information Exposure Through Error Message** (CWE-209). The active `echo $sql;` is also a developer-debug leftover that prints the entire query, including values, to the client.
|
|---|
| 원천 | ⚠️ https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/14 |
|---|
| 사용자 | 100001001X (UID 100909) |
|---|
| 제출 | 2026. 09. 01. PM 01:47 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 12. AM 11:39 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 411923 [AdithyaYelloju Restaurant-Management-System 까지 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Order Placement User/ord.php mysqli_query id/name SQL 주입] |
|---|
| 포인트들 | 0 |
|---|