| Título | dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837 SQL Injection |
|---|
| Descrição | The affected component is `Insurance_Management_System/Agent/ManagePolicy/EditPolicyHolder.php`. The page reads two GET parameters and concatenates both directly into a SQL query:
```php
$policy_no = $_GET['Policy_no'];
$name = $_GET['Name'];
$sql = "SELECT * FROM Policy_holder WHERE Policy_no = $policy_no AND Name = '$name'";
$result = mysqli_query($conn, $sql);
```
`Policy_no` is injected in a numeric context and `Name` in a quoted string context. The endpoint is effectively unauthenticated because `Agent/header.php` only issues a `Location` redirect for missing sessions without terminating execution. An attacker can extract the entire database (UNION-based extraction of `database()`, `version()`, arbitrary tables), including policy holder PII, and modify data through the same channel.
|
|---|
| Fonte | ⚠️ https://github.com/dhikshitha29/Insurance-Management-System/issues/3 |
|---|
| Utilizador | TypeThe0ry (UID 101969) |
|---|
| Submissão | 07/10/2026 15h59 (há 15 dias) |
|---|
| Moderação | 21/10/2026 08h54 (14 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 424678 [dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query Policy_no/Name Injeção SQL] |
|---|
| Pontos | 20 |
|---|