| Title | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection |
|---|
| Description | The affected components are the file/folder management methods of `admin_class.php`, all reachable unauthenticated through `ajax.php`: `save_folder()` (`name`, `parent_id`, `id`), `delete_folder()` (`id`), `delete_file()` (`id`), `file_rename()` (`name`, `type`, `folder_id`, `id`) and `save_files()` (`folder_id`, `description`). Every parameter is concatenated into SQL, e.g.:
```php
function delete_folder(){
extract($_POST);
$delete = $this->db->query("DELETE FROM folders where id =".$id);
...
}
```
```php
$chk = $this->db->query("SELECT * FROM files where SUBSTRING_INDEX(name,' ||',1) = '".$file[0]."' and folder_id = '".$folder_id."' and file_type='".$file[1]."' and id != ".$id);
```
A payload of `id=0 or 1=1` on `delete_folder` deletes every folder in the database; `folder_id=999' or '1'='1` on `file_rename` observably changes the rename result; and `name=x' or '1'='1` on `save_folder` flips the duplicate check. Because `ajax.php` has no session checks, all of this works without logging in. |
|---|
| Source | ⚠️ https://github.com/oretnom23/file-management-system-php/issues/4 |
|---|
| User | Zeming Hu (UID 101971) |
|---|
| Submission | 10/07/2026 16:10 (15 days ago) |
|---|
| Moderation | 10/21/2026 08:55 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424688 [oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 Folder Management admin_class.php name/parent_id/id/type/folder_id/description sql injection] |
|---|
| Points | 20 |
|---|