| Title | SQL Injection in Employee Payslip Generator System 1.2.0 |
|---|
| Description | An attacker authenticated as an administrator can inject SQL commands when creating new users, starting from version 1.2.0 of the Employee Payslip software, which can lead to password leaks and improper access to other existing accounts in the system.
PoC blog: https://blog.0xgabe.com/?p=90
References:
https://portswigger.net/web-security/sql-injection
https://owasp.org/www-community/attacks/SQL_Injection |
|---|
| Source | ⚠️ https://www.sourcecodester.com/php/16264/updated-employee-payslip-generator-sending-mail-using-php-and-gmail-smtp.html |
|---|
| User | Anonymous User |
|---|
| Submission | 03/11/2023 19:40 (3 years ago) |
|---|
| Moderation | 03/12/2023 08:16 (13 hours later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 222863 [SourceCodester Employee Payslip Generator with Sending Mail 1.2.0 New User Creation classes/Users.php?f=save Username sql injection] |
|---|
| Points | 20 |
|---|