| Title | z-9527 admin ≤ commit 72aaf2d SQL Injection |
|---|
| Description | A SQL injection vulnerability exists in Z-9527 Admin ≤ commit 72aaf2d at the /user/login endpoint, where the username field in the request body is concatenated directly into a SQL statement without sanitization or parameterization. As a result, unauthenticated attackers can bypass the password check, obtain a valid authentication response (JWT), and immediately assume the targeted account's identity. This can lead to account takeover, data exposure, and potential full system compromise. Mitigations include using parameterized queries or prepared statements instead of string concatenation, enforcing strict server-side input validation and escaping, storing and verifying passwords with strong hashing algorithms (e.g., bcrypt or argon2), applying least-privilege to database accounts, deploying WAF rules to detect common SQLi patterns, and conducting a comprehensive security audit of all database query construction across the codebase. |
|---|
| Source | ⚠️ https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-3 |
|---|
| User | Anonymous User |
|---|
| Submission | 02/14/2026 14:48 (2 months ago) |
|---|
| Moderation | 02/25/2026 15:04 (11 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 347772 [z-9527 admin 1.0/2.0 user.js checkName/register/login/getUser/getUsers sql injection] |
|---|
| Points | 0 |
|---|