| Title | SourceCodester Simple Student Attendance System using PHP and MySQL 1.0 SQL Injection |
|---|
| Description | The vulnerability exists in the student_form.php file at line 6, where the id parameter is accepted without proper sanitization and validation. This id parameter is subsequently passed to the get_student() function located in actions.class.php at line 127. Due to insufficient input validation, this allows for SQL Injection attacks. Attackers can exploit this vulnerability to execute arbitrary SQL commands, leading to various types of SQL Injection attacks such as boolean-based blind, time-based blind, and UNION queries. Successful exploitation of this vulnerability resulted in unauthorized access to the database, disclosure of sensitive information, modification of data, or even complete compromise of the affected system. |
|---|
| Source | ⚠️ https://docs.google.com/document/d/1YkKZYuecpT5ZLtwgNBCYA-H-dfOhevYP2C-B4PBZv50/edit?usp=sharing |
|---|
| User | R0ck3t (UID 70759) |
|---|
| Submission | 06/18/2024 19:57 (2 years ago) |
|---|
| Moderation | 06/20/2024 19:25 (2 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 247365 [SourceCodester Simple Student Attendance System 1.0 /modals/student_form.php id sql injection] |
|---|
| Points | 0 |
|---|