| 제목 | SourceCodester Performance Indicator System 1.0 SQL Injection |
|---|
| 설명 | During a security review of SourceCodester Performance Indicator System V1.0, a SQL injection vulnerability was identified in the category parameter of /opils/admin/view_product.php.
The value is used directly in an SQL WHERE clause without prepared statements, type validation, or escaping. Although the file is located under the admin directory, its authorization check only verifies that a session exists and does not verify the user's role. As a result, a low-privilege Dealer can reach and exploit the query.
sqlmap identified boolean-based blind, time-based blind, and UNION query injection. A manual UNION request also extracted usernames and plaintext passwords from the application database. A separate injected SLEEP(3) condition delayed the response for approximately three seconds. |
|---|
| 원천 | ⚠️ https://github.com/OnlyCMJB/cve/issues/4 |
|---|
| 사용자 | OnlyCMJB (UID 100094) |
|---|
| 제출 | 2026. 09. 21. PM 04:27 (16 날 ago) |
|---|
| 모더레이션 | 2026. 10. 06. AM 10:26 (15 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413926 [SourceCodester Performance Indicator System 1.0 view_product.php category SQL 주입] |
|---|
| 포인트들 | 20 |
|---|