| Title | satya-vinay Events-Management-System 437c77ceb69bf9fe2e3f4f46f7871b83f425383a SQL Injection |
|---|
| Description | The affected component is `dodelete.php` (site root), the unauthenticated registration-delete handler. The record id is taken raw from `$_REQUEST` and concatenated directly into a `DELETE` statement with no escaping and no authentication:
```php
include("dbconnect.php");
$id=$_REQUEST["id"];
$query=mysqli_query($db_connect, "delete from symbols where id = '$id' ");
```
A payload such as `1' OR '1'='1` makes the WHERE clause always true, deleting every row in the `symbols` table in a single unauthenticated request. Verified in the test environment: the injection removed all 6 stored registration records. Because the page reads `$_REQUEST`, the destructive query can also be triggered with a plain GET link.
|
|---|
| Source | ⚠️ https://github.com/satya-vinay/Events-Management-System/issues/3 |
|---|
| User | xbjds (UID 101126) |
|---|
| Submission | 10/04/2026 17:47 (21 days ago) |
|---|
| Moderation | 10/19/2026 07:23 (15 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422247 [satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a Registration-Delete dodelete.php id sql injection] |
|---|
| Points | 20 |
|---|