Submeter #880670: itsourcecode itsourcecode Electronic Judging System Project V1.0 V1.0 SQL Injection

During the security review of "BCC Intrams Electronic Judging System", I discovered a critical SQL injection and missing authentication vulnerability in the file. This file contains only 9 lines of PHP code yet harbors three fatal defects: no session verification, direct user input concatenation into SQL, and silently suppressing all errors. An attacker only needs to enter a carefully crafted URL in the browser address bar to delete all records in the table within seconds. This vulnerability can be fully automated for mass exploitation, produces no server-side error logs during the attack, and the frontend still displays the misleading "Judge successfully removed" alert. Immediate remedial measures are needed to ensure system security and protect competition data integrity./admin/delete_judge.phperror_reporting(0)judges
Attackers can exploit this vulnerability to delete all judge records from the table with a single HTTP GET request without any authentication, leading to:judges
Complete data integrity loss: All judge information is irreversibly destroyed
Business continuity disruption: The scoring system becomes inoperable, forcing event cancellation
Competition fairness compromised: Selective deletion of judges can manipulate competition results

• Fonte: ⚠️ https://github.com/i-QvQ-i/first-OvO/issues/8
• Utilizador: i-OvO-i (UID 97659)
• Submissão: 05/07/2026 17h32 (há 3 meses)
• Moderação: 20/08/2026 10h43 (2 months later)
• Estado: Duplicado
• Entrada VulDB: 365547 [itsourcecode Electronic Judging System 1.0 /admin/delete_judge.php judge_id Injeção SQL]
• Pontos: 0