| tiêu đề | code-projects Pharmacy Management System 1.0 SQL Injection |
|---|
| Mô tả | A **critical SQL injection vulnerability** has been identified in the **Pharmacy Management System** version 1.0, specifically during the **invoice creation process**. The issue lies in how the system retrieves the list of medicines based on a search query passed through the `text` parameter. The input is not properly sanitized, allowing attackers to inject and execute arbitrary SQL commands.
When creating a new invoice, the system queries the medicine database using the `text` parameter to display matching results. However, the lack of input validation makes it vulnerable to SQL injection attacks. Exploiting this flaw could allow unauthorized access to sensitive data, such as medicine inventory details, and even manipulation or deletion of records. This vulnerability is **critical**, as it compromises both the availability and integrity of the system. Immediate remediation is necessary to avoid disruption of pharmaceutical operations and data breaches. |
|---|
| Nguồn | ⚠️ https://gist.github.com/higordiego/be616d2853a9f1820d8558fc00e97e24 |
|---|
| Người dùng | c4ttr4ck (UID 75518) |
|---|
| Đệ trình | 19/10/2024 17:59 (cách đây 2 những năm) |
|---|
| Kiểm duyệt | 20/10/2024 20:49 (1 day later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 281021 [code-projects Pharmacy Management System 1.0 /add_new_invoice.php text Tiêm SQL] |
|---|
| điểm | 20 |
|---|