| Title | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection |
|---|
| Description | The affected component is the `save_user()` method of `admin_class.php`, invoked by `ajax.php?action=save_user`. `ajax.php` performs no authentication, and `save_user()` concatenates every posted field directly into an INSERT/UPDATE statement:
```php
function save_user(){
extract($_POST);
$data = " name = '$name' ";
$data .= ", username = '$username' ";
$data .= ", password = '$password' ";
$data .= ", type = '$type' ";
if(empty($id)){
$save = $this->db->query("INSERT INTO users set ".$data);
}else{
$save = $this->db->query("UPDATE users set ".$data." where id = ".$id);
}
if($save){
return 1;
}
}
```
Any unauthenticated remote user can insert a new account with `type=1` (administrator) and a password of their choice, then log in normally; with the `id` parameter they can also overwrite existing accounts, including resetting the administrator password. All four string fields are SQL-injectable. |
|---|
| Source | ⚠️ https://github.com/oretnom23/file-management-system-php/issues/3 |
|---|
| User | Zeming Hu (UID 101971) |
|---|
| Submission | 10/07/2026 16:10 (17 days ago) |
|---|
| Moderation | 10/21/2026 08:55 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424687 [oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 User Account Management admin_class.php save_user name/username/password/type/id sql injection] |
|---|
| Points | 20 |
|---|