| Title | code-projects Student Crud Operation In PHP 1.0 SQL Injection |
|---|
| Description | Student CRUD Operation in PHP contains a suspected time-based blind SQL Injection vulnerability in the id parameter of the student editing functionality implemented by edit.php.
The application uses the id query-string parameter to identify the student record that should be retrieved or modified. The parameter is expected to contain a student identifier, but security testing indicates that specially constructed database expressions can be supplied instead.
During testing, the following expression was inserted into id:
(select*from(select(sleep(20)))a)
The expression is designed to cause the database operation to pause if the supplied value is interpreted as part of SQL syntax rather than being handled strictly as an identifier.
Time-based blind SQL injection is particularly relevant when an application does not return database results or SQL errors directly to the client. Instead, database query execution can be inferred from a controlled difference in application response time.
If a normal request using a legitimate student identifier returns without the corresponding delay while the modified request consistently produces an approximately 20-second database-controlled delay, this provides evidence that attacker-controlled input can influence SQL execution.
The vulnerability would occur because the application fails to maintain a strict separation between the id value supplied by the client and SQL instructions executed by the backend database.
The issue affects student-record editing functionality and could therefore potentially compromise the confidentiality or integrity of information accessible to the affected database query.
The exact impact depends on the SQL statement in edit.php, the privileges assigned to the application's database account, and whether additional SQL injection techniques are possible. |
|---|
| Source | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Student%20CRUD%20Operation%20in%20PHP%20%E2%80%93%20Time-Based%20Blind%20SQL%20Injection%20in%20%60edit.php%60%20via%20%60id%60%20Parameter.md |
|---|
| User | AhmadMarzouk (UID 95993) |
|---|
| Submission | 07/29/2026 18:41 (1 month ago) |
|---|
| Moderation | 09/07/2026 21:29 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 399672 [code-projects Student Crud Operation 1.0 /edit.php ID sql injection] |
|---|
| Points | 20 |
|---|