| Title | dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837 SQL Injection |
|---|
| Description | The affected component is `Insurance_Management_System/Admin/View/editPlan.php`. The page reads two GET parameters and concatenates both directly into a SQL query without any prepared statement or escaping:
```php
$plan_no = $_GET['Plan_no'];
$name = $_GET['Name'];
$sql = "SELECT * FROM Plan WHERE Plan_no = $plan_no AND Name = '$name'";
$result = mysqli_query($conn, $sql);
```
`Plan_no` is injected in a numeric context and `Name` in a quoted string context, so both are injectable. The endpoint is effectively unauthenticated because `Admin/header.php` only issues a `Location` redirect for missing sessions without terminating execution, so the query still runs. An attacker can read the entire database (UNION-based extraction of `database()`, `version()`, arbitrary tables) and alter or delete data through the same query channel.
|
|---|
| Source | ⚠️ https://github.com/dhikshitha29/Insurance-Management-System/issues/2 |
|---|
| User | JUNYOU FENG (UID 101968) |
|---|
| Submission | 10/07/2026 15:57 (26 days ago) |
|---|
| Moderation | 10/21/2026 08:54 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424677 [dhikshitha29 Insurance-Management-System /Admin/View/editPlan.php mysqli_query Plan_no/Name sql injection] |
|---|
| Points | 20 |
|---|