| Title | code-projects Product Inventory System in PHP 1.0 SQL Injection |
|---|
| Description | Product Inventory System in PHP version 1.0, an open-source inventory management application distributed through code-projects.org, contains a critical pre-authentication SQL injection vulnerability in its login functionality, specifically in how it processes the password field submitted via POST to the root login endpoint (index.php). The application builds its authentication query by directly concatenating raw, unsanitized user input into a SQL statement executed through the deprecated mysql_query() function, with no parameterized queries or input validation in place. This allows an unauthenticated remote attacker to inject arbitrary SQL syntax simply by submitting a crafted login request, with no valid credentials, user interaction, or prior access required. The vulnerability was first confirmed manually by injecting a time-based blind SQL payload into the password parameter, which caused a consistent multi-second delay in the server's response, and was then further validated using SQLMap against the captured login request. SQLMap confirmed the password parameter is exploitable via boolean-based blind, error-based, and time-based blind SQL injection techniques. Using this injection point, it was possible to enumerate every database present on the backend MySQL/MariaDB server, dump the contents of the application's user table to extract stored usernames, passwords, and privilege levels, and fully bypass the login mechanism. In the tested environment, the database account used by the application held excessive privileges, which allowed SQLMap's --os-shell feature to obtain a functioning operating system shell and execute arbitrary commands on the underlying server, demonstrating that this SQL injection can escalate to full remote code execution depending on the deployment's database privilege configuration. Given the absence of any authentication, privilege, or user-interaction requirements combined with the severity of achievable impact. |
|---|
| Source | ⚠️ https://github.com/KaranParelkar/SQLI-in-Product-Inventory-System-password-parameter |
|---|
| User | KaranParelkar (UID 99714) |
|---|
| Submission | 07/26/2026 18:33 (2 months ago) |
|---|
| Moderation | 09/06/2026 16:32 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 314283 [code-projects Product Inventory System 1.0 Login /index.php Username sql injection] |
|---|
| Points | 0 |
|---|