| Title | PHPGurukul Directory Management System v2.0 SQL Injection |
|---|
| Description | A SQL injection vulnerability exists in PHPGurukul Directory Management System 2.0 within the admin/forget-password.php component. The email and mobilenumber POST parameters are concatenated directly into an SQL query without sufficient validation or parameterized queries.
An unauthenticated remote attacker can manipulate the email parameter to make the password recovery query return a valid administrator record. The application subsequently allows the attacker to access the password reset workflow and set a new administrator password.
Successful exploitation can result in authentication bypass and complete administrator account takeover. |
|---|
| Source | ⚠️ https://github.com/baihu-art/PHPGurukul-Directory-Management-System-Project-V2.0 |
|---|
| User | baihu (UID 88498) |
|---|
| Submission | 09/24/2026 06:02 (1 month ago) |
|---|
| Moderation | 10/11/2026 19:58 (18 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 308997 [PHPGurukul Directory Management System 2.0 forget-password.php email sql injection] |
|---|
| Points | 0 |
|---|