Submit #1018609: oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection

The affected component is `download.php`. The `id` GET parameter is concatenated into a query and the returned `file_path` column is passed to `readfile()` without any validation:

```php
$qry = $conn->query("SELECT * FROM files where id=".$_GET['id'])->fetch_array();
...
$fname=$qry['file_path'];
$file = ("assets/uploads/".$fname);
header ("Content-Type: ".filetype($file));
header ("Content-Length: ".filesize($file));
header ("Content-Disposition: attachment; filename=".$qry['name'].'.'.$qry['file_type']);
readfile($file);
```

The endpoint has no authentication. With a UNION payload the attacker controls `file_path` and can traverse out of `assets/uploads/`, e.g. `id=0 union select 1,2,3,4,5,6,'../../../../../etc/passwd',8,9` returns the server's `/etc/passwd`, and `'../../db_connect.php'` returns the source code with database credentials. The same channel extracts arbitrary data from any database table.

• Source: ⚠️ https://github.com/oretnom23/file-management-system-php/issues/5
• User: Zeming Hu (UID 101971)
• Submission: 10/07/2026 16:11 (14 days ago)
• Moderation: 10/21/2026 08:55 (14 days later)
• Status: Accepted
• VulDB entry: 424689 [oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Download download.php readfile id sql injection]
• Points: 20