Submit #678529: PHPGurukul User Registration & Login and User Management System With admin panel 3.3 SQL Injection

Multiple SQL Injection (CWE‑89) vulnerabilities were identified in the “User Registration and login System with admin panel” project (scanned copy located in loginsystem/). Static analysis with Semgrep (PHP + OWASP packs) flagged 53 SQL‑related findings across 28 PHP files, including authentication (login.php, admin/index.php), registration (signup.php), password recovery (password-recovery.php), profile management (edit-profile.php, user-profile.php), search/reporting (admin/search-result.php, admin/bwdates-report-result.php), and administrative user‑management scripts (admin/manage-users.php, admin/lastsevendays-reg-users.php, admin/lastthirtyays-reg-users.php, admin/yesterday-reg-users.php). The vulnerable pattern observed is direct interpolation or concatenation of user‑controlled input (e.g., $useremail, $password, $adminid, $searchkey, $fdate, $tdate, $fname, $lname, $email, $contact) into SQL query strings executed via mysqli_query(), enabling potential authentication bypass, unauthorized disclosure, modification or deletion of database records, and other impacts typical of SQL Injection. Findings were observed on 2025‑10‑20. In total, 53 SQL injection points were identified across the scanned PHP files, impacting both unauthenticated and authenticated administrative functionality. These vulnerabilities correspond to CWE-89 (SQL Injection) and pose a high risk for database compromise and unauthorized access.

• Source: ⚠️ https://github.com/NishantKumar-CSE/User-Registration-Login-and-User-Management-System-With-admin-panel/blob/main/Multple_SQL_Injection
• User: Nishant_Kumar (UID 91843)
• Submission: 10/20/2025 14:40 (12 months ago)
• Moderation: 11/02/2025 07:29 (13 days later)
• Status: Duplicate
• VulDB entry: 316239 [PHPGurukul User Registration & Login and User Management System /admin/manage-users.php sql injection]
• Points: 0