| Название | PHPGurukul Blood Donor Management System Using CodeIgniter 1.0 SQL Injection |
|---|
| Описание | Blood Donor Management System Using CI V1.0 contains an unauthenticated SQL Injection vulnerability in the /admin/Report endpoint. The vulnerability exists because the authentication check in the Report controller constructor is entirely commented out, making the endpoint publicly accessible without login and form validation only checks if fromdate and todate are "required" — no date format or type validation is performed and concatenates raw POST values directly into a SQL string via $this->db->where("date(create_date) between '$fdate' and '$tdate'"). CodeIgniter's Query Builder does not escape raw string arguments to where(), so the entire string is passed to MySQL as-is. An attacker can submit an injection payload in either date field to execute arbitrary SQL queries. |
|---|
| Источник | ⚠️ https://github.com/usernamevnq/CVEs/issues/2 |
|---|
| Пользователь | n4k3r0 (UID 91985) |
|---|
| Представление | 12.08.2026 10:01 (1 месяц назад) |
|---|
| Модерация | 14.09.2026 07:03 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 403393 [PHPGurukul Blood Donor Management System 1.0 Report Endpoint Report.php fromdate/todate SQL-инъекция] |
|---|
| Баллы | 20 |
|---|