Submeter #1035915: SourceCodestere Simple CRUD using PHP and FPDF V1.0 SQL Injection

Validation Method

The finding was validated with sqlmap in a local authorized test environment. The sqlmap command and key output are included below so the parameter, injection type, payload, vector, backend DBMS, and any actual enumeration result can be reviewed.

Vulnerable Location

Affected File: app/register.php (line 12)
Vulnerable Parameter: firstname
Affected Endpoint: https://target.example/register.php
HTTP Method: POST
Vulnerability Overview

The Simple CRUD using PHP and FPDF application does not properly validate or sanitize user input for the firstname parameter. This results in a time-based blind SQL injection vulnerability. An attacker needs network access to the application and a valid authenticated user session. An attacker can construct and execute malicious SQL statements through the affected endpoint and backend SQL sink.

Problem Type and Root Cause

Type: SQL Injection
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Root Cause: User-supplied input from the firstname parameter flows into a raw SQL execution path without prepared statements, safe parameter binding, or strict allowlist validation. This allows attacker-controlled input to alter the intended query logic.
Impact

Attack Conditions: Network access to the endpoint and an authenticated authenticated user session are required.
Potential Impact: The verified evidence proves attacker-controlled SQL query alteration and backend DBMS fingerprinting. Depending on the affected query and application privileges, exploitation may support unauthorized data access or modification; final submission impact should remain limited to the collected evidence.

• Fonte: ⚠️ https://github.com/cm126261/CVE/issues/2
• Utilizador: Smartiesxum (UID 102012)
• Submissão: 15/10/2026 13h49 (há 24 dias)
• Moderação: 08/11/2026 17h41 (24 days later)
• Estado: Aceite
• Entrada VulDB: 432917 [SourceCodester Simple CRUD using PHP and FPDF 1.0 app/register.php firstname Injeção SQL]
• Pontos: 20