Submit #1011414: Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d SQL Injection

The affected component is the `farmers/` module (`add.php`, `edit.php`, `validate.php`). These files concatenate unsanitized `$_POST` fields (`f_no`, `f_id`, `f_name`, `f_locallity`, `f_ac`, `f_phone`) directly into SQL statements without any escaping or prepared statements. In `farmers/validate.php` the input is used inside `SELECT` queries, and in `farmers/add.php` / `farmers/edit.php` it is used inside `INSERT` / `UPDATE` statements:

```php
// farmers/validate.php
$idresult = mysqli_query($conn,"select * from farmers where f_id= '$f_id' ") or die("unable to fetch records" . mysqli_error($conn));
$noresult = mysqli_query($conn,"select * from farmers where f_no= '$f_no' ") or die("unable to fetch records" . mysqli_error($conn));
```

```php
// farmers/add.php
$sql = "INSERT INTO `farmers` ( `f_no` ,`f_id` , `f_name` , `f_locallity` , `f_ac` , `f_phone` ) VALUES( '{$_POST['f_no']}' ,'{$_POST['f_id']}' , '{$_POST['f_name']}' , '{$_POST['f_locallity']}' , '{$_POST['f_ac']}' , '{$_POST['f_phone']}' ) ";
mysqli_query($conn,$sql) or die(mysqli_error($conn));
```

```php
// farmers/edit.php
$sql = "UPDATE farmers SET f_no = '{$_POST['f_no']}' ,f_id = '{$_POST['f_id']}' , f_name = '{$_POST['f_name']}' , f_locallity = '{$_POST['f_locallity']}' , f_ac = '{$_POST['f_ac']}' , f_phone = '{$_POST['f_phone']}' WHERE f_no = '$f_no' ";
$rslt = mysqli_query($conn,$sql) or die(mysqli_error($conn));
```

Any authenticated user can exploit this because `farmers/add.php` performs no role check (even the lowest-privilege `Clerk` role is allowed). A time-based payload such as `1' OR SLEEP(4) -- -` in `f_id` produced a multi-second delay and a MySQL syntax error, confirming injection. The flaw allows an attacker to read, modify, or delete arbitrary database records (farmers, deliveries, employees), tamper with or reset the administrator password, and fully compromise the application database.

• Source: ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/2
• User: 7z2Z (UID 101867)
• Submission: 10/02/2026 14:20 (16 days ago)
• Moderation: 10/18/2026 18:25 (16 days later)
• Status: Accepted
• VulDB entry: 421853 [Dav-ee dairy-management-system farmers/add.php mysqli_query f_no/f_id/f_name/f_locallity/f_ac/f_phone sql injection]
• Points: 20