| Title | mansi-k Restaurant_IMS * SQL Injection |
|---|
| Description | Restaurant_IMS contains multiple SQL injection vulnerabilities allowing authentication bypass and database manipulation. 1. Authentication Bypass (Critical) - File: lsmodal.php line 7 - Query: SELECT * FROM users WHERE u_email='$login_id' and u_pswd='$epsw' - Attack vector: Set l-email to: ' OR '1'='1' -- - Result: Login as any user without password2. Admin Authentication Bypass (Critical) - File: adminlogin.php line 8 - Query: SELECT * FROM admin WHERE a_name='$login_id' and a_pswd='$epsw' - Attack vector: Set a-name to: admin1'-- - Result: Full admin panel access without password3. Hard-coded Database Credentials (Critical) - File: dbconnect.php line 2 - Code: mysqli_connect("localhost","root","") - No password required, root database access granted |
|---|
| Source | ⚠️ https://github.com/mansi-k/Restaurant_IMS |
|---|
| User | Rishaank (UID 101439) |
|---|
| Submission | 09/19/2026 14:26 (1 month ago) |
|---|
| Moderation | 10/24/2026 11:24 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426096 [mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 lsmodal.php mysqli_connect login_id/epsw sql injection] |
|---|
| Points | 20 |
|---|