| Title | satya-vinay Events-Management-System 437c77ceb69bf9fe2e3f4f46f7871b83f425383a SQL Injection |
|---|
| Description | The affected component is `doedit.php` (site root), the unauthenticated registration-edit handler. All eight `$_REQUEST` parameters are concatenated directly into an `UPDATE` statement without escaping, and the page enforces no authentication:
```php
$id=$_REQUEST['id'];
$name=$_REQUEST['name'];
...
$query=mysqli_query($db_connect," UPDATE symbols SET name='$name',title='$title',year='$year',gender='$gender',fromdate='$fromdate',todate='$todate',people='$people' WHERE id='$id' ");
```
An injected comment (`#`) terminates the statement early and removes the `WHERE id=...` restriction, turning a single-row edit into a mass UPDATE of the entire table. Verified: injecting `title=(SELECT SLEEP(3))` into the `name` field delayed the response by 18 seconds (6 stored rows × 3 seconds), and the injected subquery result was written into the `title` column of every row.
|
|---|
| Source | ⚠️ https://github.com/satya-vinay/Events-Management-System/issues/2 |
|---|
| User | xbjds (UID 101126) |
|---|
| Submission | 10/04/2026 17:46 (21 days ago) |
|---|
| Moderation | 10/19/2026 07:22 (15 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422246 [satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a Registration-Edit doedit.php mysqli_query id/name/title/year/gender/fromdate/todate/people sql injection] |
|---|
| Points | 20 |
|---|