| Название | itsourcecode St Columban Student Information Management System 1.0 SQL Injection |
|---|
| Описание | During the security review of "St Columban Student Information Management System" v1.0 (free PHP project distributed by itsourcecode.com), I discovered a critical unauthenticated SQL injection vulnerability in "/admin/login.php" (POST parameter "uname").
The login handler applies only trim() to the username (admin/login.php:50) and interpolates it directly into the authentication query (includes/member.php:35):
SELECT * FROM `useraccounts` WHERE `ACCOUNT_USERNAME`='" . $email . "' and `ACCOUNT_PASSWORD`='" . $h_upass . "' LIMIT 1
The codebase's only escaper (Database::escape_value) is never invoked on this path. Because the password is SHA1-hashed before the query, the injection lives in "uname" and comments out the password predicate; an injected LIMIT 1 satisfies the row_count==1 check (includes/member.php:38).
An unauthenticated remote attacker can therefore bypass authentication and log in as any account, including the seeded Administrator, gaining full control of the application and all student records.
Proof of Concept (verified on a local deployment of the unmodified vendor source):
POST /columbans/admin/login.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
btnlogin=Login&uname='+OR+1=1+LIMIT+1--+ -&pass=x
Result: the session is populated with the first useraccounts row (ACCOUNT_ID=1, Administrator) and the attacker lands on the admin dashboard. A targeted variant also works: ' OR ACCOUNT_TYPE='Administrator' LIMIT 1-- -
Additional observation: the shipped database dump (columbandb.sql) stores unsalted SHA1 password hashes; 6 of 8 seeded accounts share 7110eda4d09e062aa5e4a390b0a572ac0d2c0220 = sha1("1234").
Full evidence (HTTP transcripts, authenticated dashboard screenshots, Docker reproduction environment): see the advisory link. |
|---|
| Пользователь | chaos4 (UID 100466) |
|---|
| Представление | 09.08.2026 18:11 (2 месяцы назад) |
|---|
| Модерация | 13.09.2026 15:48 (1 month later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 322985 [itsourcecode Student Information Management System 1.0 /admin/login.php uname SQL-инъекция] |
|---|
| Баллы | 0 |
|---|