Submit #846332: code-projects Interview Management System in PHP 1.0 SQL Injection

A SQL Injection vulnerability exists in the question editing functionality of Interview Management System in PHP version 1.0.

The endpoint editQuestion.php retrieves the question to edit and processes an update through two methods in the application's class layer. In both cases, the GET parameter id is directly concatenated into the SQL query string before being passed to PDO's prepare(). Since PDO only prevents injection when placeholders (?) are used — not when variables are pre-embedded in the query string — the use of prepare() here provides no protection:

In View::viewEditQuestions() (inc/classes/View.php):

function viewEditQuestions(){
$questionId = $_GET['id'];
$sql = "select * from questions where question_id = $questionId";
$query = $this->db->simplequerywithoutcondition($sql);

In Create::editQuestion() (inc/classes/Create.php):

public function editQuestion($data){
$questionId = $_GET['id'];
$sql = "update questions set question = ? where question_id = $questionId";
$arr = array($question);
$results = $this->db->simplequery($sql, $arr);

Both queries execute immediately with the injected id value. The SELECT is exploitable for data extraction; the UPDATE allows modification of any question record by manipulating the WHERE clause.

• Source: ⚠️ https://gist.github.com/c4ttr4ck/dfddf8167cfd8170def2578b3b6831af
• User: c4ttr4ck (UID 75518)
• Submission: 06/02/2026 20:20 (1 month ago)
• Moderation: 07/03/2026 20:33 (1 month later)
• Status: Duplicate
• VulDB entry: 208134 [janobe Interview Management System 1.0 editQuestion.php ID sql injection]
• Points: 0