| Название | PHPGurukul Directory Management System v2.0 SQL Injection |
|---|
| Описание | A SQL injection vulnerability exists in PHPGurukul Directory Management System 2.0 within the admin/forget-password.php component. The email and mobilenumber POST parameters are concatenated directly into an SQL query without sufficient validation or parameterized queries.
An unauthenticated remote attacker can manipulate the email parameter to make the password recovery query return a valid administrator record. The application subsequently allows the attacker to access the password reset workflow and set a new administrator password.
Successful exploitation can result in authentication bypass and complete administrator account takeover. |
|---|
| Источник | ⚠️ https://github.com/baihu-art/PHPGurukul-Directory-Management-System-Project-V2.0 |
|---|
| Пользователь | baihu (UID 88498) |
|---|
| Представление | 24.09.2026 06:02 (1 месяц назад) |
|---|
| Модерация | 11.10.2026 19:58 (18 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 308997 [PHPGurukul Directory Management System 2.0 forget-password.php email SQL-инъекция] |
|---|
| Баллы | 0 |
|---|