| Title | dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837 SQL Injection |
|---|
| Description | The affected component is `Insurance_Management_System/Agent/ManagePolicy/EditPolicyHolder.php`. The page reads two GET parameters and concatenates both directly into a SQL query:
```php
$policy_no = $_GET['Policy_no'];
$name = $_GET['Name'];
$sql = "SELECT * FROM Policy_holder WHERE Policy_no = $policy_no AND Name = '$name'";
$result = mysqli_query($conn, $sql);
```
`Policy_no` is injected in a numeric context and `Name` in a quoted string context. The endpoint is effectively unauthenticated because `Agent/header.php` only issues a `Location` redirect for missing sessions without terminating execution. An attacker can extract the entire database (UNION-based extraction of `database()`, `version()`, arbitrary tables), including policy holder PII, and modify data through the same channel.
|
|---|
| Source | ⚠️ https://github.com/dhikshitha29/Insurance-Management-System/issues/3 |
|---|
| User | TypeThe0ry (UID 101969) |
|---|
| Submission | 10/07/2026 15:59 (25 days ago) |
|---|
| Moderation | 10/21/2026 08:54 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424678 [dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query Policy_no/Name sql injection] |
|---|
| Points | 20 |
|---|