Submit #1018606: oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection

The affected component is the `login()` method of `admin_class.php`, invoked by `ajax.php?action=login`. The username and password are concatenated directly into the query:

```php
function login(){
extract($_POST);
$qry = $this->db->query("SELECT * FROM users where username = '".$username."' and password = '".$password."' ");
if($qry->num_rows > 0){
foreach ($qry->fetch_array() as $key => $value) {
if($key != 'passwors' && !is_numeric($key))
$_SESSION['login_'.$key] = $value;
}
return 1;
}else{
return 2;
}
}
```

A payload such as `username=admin' or '1'='1' limit 1 -- -` with any password makes the condition true and comments out the password check. The script then copies every column of the matched user row (including `id`, `type`, `name`) into the session, so the attacker obtains an authenticated administrator session without knowing any credentials.

• Source: ⚠️ https://github.com/oretnom23/file-management-system-php/issues/2
• User: Zeming Hu (UID 101971)
• Submission: 10/07/2026 16:09 (15 days ago)
• Moderation: 10/21/2026 08:55 (14 days later)
• Status: Accepted
• VulDB entry: 424686 [oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 admin_class.php login username/password sql injection]
• Points: 20