| Название | SourceCodester Simple Student Attendance System using PHP and MySQL 1.0 SQL Injection |
|---|
| Описание | The vulnerability exists in the student_form.php file at line 6, where the id parameter is accepted without proper sanitization and validation. This id parameter is subsequently passed to the get_student() function located in actions.class.php at line 127. Due to insufficient input validation, this allows for SQL Injection attacks. Attackers can exploit this vulnerability to execute arbitrary SQL commands, leading to various types of SQL Injection attacks such as boolean-based blind, time-based blind, and UNION queries. Successful exploitation of this vulnerability resulted in unauthorized access to the database, disclosure of sensitive information, modification of data, or even complete compromise of the affected system. |
|---|
| Источник | ⚠️ https://docs.google.com/document/d/1YkKZYuecpT5ZLtwgNBCYA-H-dfOhevYP2C-B4PBZv50/edit?usp=sharing |
|---|
| Пользователь | R0ck3t (UID 70759) |
|---|
| Представление | 18.06.2024 19:57 (2 лет назад) |
|---|
| Модерация | 20.06.2024 19:25 (2 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 247365 [SourceCodester Simple Student Attendance System 1.0 /modals/student_form.php id SQL-инъекция] |
|---|
| Баллы | 0 |
|---|