| 제목 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection |
|---|
| 설명 | The affected component is `admin/login.php`. The administrator login endpoint interpolates `$_POST['username']` and `$_POST['password']` directly into the query that validates the `users` table:
```php
$username = $_POST['username'];
$password = $_POST['password'];
$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'")or die(mysql_error());
$count = mysql_num_rows($query);
$row = mysql_fetch_array($query);
if ($count > 0){
$_SESSION['id']=$row['user_id'];
echo 'true';
mysql_query("insert into user_log (username,login_date,user_id)values('$username',NOW(),".$row['user_id'].")")or die(mysql_error());
}else{
echo 'false';
}
```
An unauthenticated attacker can send `' OR 1=1 LIMIT 1 -- -` as the username to match an arbitrary row of the `users` table, receive `true`, and obtain an authenticated administrator session (`$_SESSION['id']` = that user's id) without any password. The same injection point is also a general SQL injection primitive against the `capstone` database, and the shipped database dump `db/NSBM.sql` contains the default administrator account `('admin','admin')`, so an attacker who reaches the panel can log in with well-known credentials as well.
|
|---|
| 원천 | ⚠️ https://github.com/KusalkaSilva/Learning-Management-System/issues/2 |
|---|
| 사용자 | yinian328 (UID 101459) |
|---|
| 제출 | 2026. 09. 20. PM 05:20 (16 날 ago) |
|---|
| 모더레이션 | 2026. 10. 06. AM 07:49 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413893 [Kusalkasilva Learning-Management-System 까지 ffeb873f8803f1e9664384ff75000c7da45466d2 Administrator Login Endpoint admin/login.php mysql_query username/password SQL 주입] |
|---|
| 포인트들 | 20 |
|---|