Submit #1018610: oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 SQL Injection

The affected components are the page files included by `index.php`: `files.php` (`fid` GET parameter), `manage_user.php`, `manage_files.php` and `manage_folder.php` (`id` GET parameter). Each concatenates the parameter directly into a query, e.g.:

```php
// files.php
$folder_parent = isset($_GET['fid'])? $_GET['fid'] : 0;
$folders = $conn->query("SELECT * FROM folders where parent_id = $folder_parent and user_id = '".$_SESSION['login_id']."' order by name asc");
```

```php
// manage_user.php
$user = $conn->query("SELECT * FROM users where id =".$_GET['id']);
```

```php
// manage_files.php / manage_folder.php
$qry = $conn->query("SELECT * FROM files where id=".$_GET['id']);
$qry = $conn->query("SELECT * FROM folders where id=".$_GET['id']);
```

Because `index.php` only redirects without exiting when no session exists, all of these are reachable unauthenticated. UNION payloads extract database contents, which `manage_user.php` and the other pages then render directly into the response (form prefill, folder cards).

• Source: ⚠️ https://github.com/oretnom23/file-management-system-php/issues/6
• User: Zeming Hu (UID 101971)
• Submission: 10/07/2026 16:11 (15 days ago)
• Moderation: 10/21/2026 08:55 (14 days later)
• Status: Accepted
• VulDB entry: 424690 [oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 File Management files.php fid/id sql injection]
• Points: 20