| 제목 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection |
|---|
| 설명 | The affected component is `login.php` (repository root). The endpoint reads `$_POST['username']` and `$_POST['password']` and concatenates them directly into two authentication queries, one against the `student` table and one against the `teacher` table:
```php
$username = $_POST['username'];
$password = $_POST['password'];
/* student */
$query = "SELECT * FROM student WHERE username='$username' AND password='$password'";
$result = mysql_query($query)or die(mysql_error());
...
/* teacher */
$query_teacher = mysql_query("SELECT * FROM teacher WHERE username='$username' AND password='$password'")or die(mysql_error());
```
No authentication, escaping, or parameterization is applied. An unauthenticated attacker can inject `' OR 1=1 -- -` into `username` to make the WHERE clause always true; the first row of the `student` table is then loaded and `$_SESSION['id']` is set to that student's id, so the attacker is logged in as an arbitrary existing user without knowing any password. Because the raw database error is printed with `or die(mysql_error())`, the same endpoint also works as an error-based SQL injection primitive (e.g. `UPDATEXML`/`CONCAT` payloads leak arbitrary column values such as the stored plaintext passwords). Combined with the plaintext password storage of this application, a single unauthenticated request is enough to take over any student or teacher account. |
|---|
| 원천 | ⚠️ https://github.com/KusalkaSilva/Learning-Management-System/issues/1 |
|---|
| 사용자 | yinian328 (UID 101459) |
|---|
| 제출 | 2026. 09. 20. PM 05:19 (17 날 ago) |
|---|
| 모더레이션 | 2026. 10. 06. AM 07:49 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413892 [Kusalkasilva Learning-Management-System 까지 ffeb873f8803f1e9664384ff75000c7da45466d2 Login Endpoint login.php mysql_error username/password SQL 주입] |
|---|
| 포인트들 | 20 |
|---|