| tiêu đề | PHPGurukul User Registration & Login and User Management System V3.3 V3.3 SQL Injection |
|---|
| Mô tả | An authenticated SQL Injection (CWE-89) exists in “User Registration & Login and User Management System With Admin Panel” v3.3 at /loginsystem/admin/user-profile.php. The GET parameter uid is concatenated directly into a SQL string without validation or parameterization, enabling both boolean-based and time-based blind injection.
Vulnerable code (example):
$userid = $_GET['uid'];
$query = mysqli_query($con, "select * from users where id='$userid'");
Reproduction (after logging into the admin panel):
- Time-based blind (observe a ~5s delay):
uid=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))x)-- -
- Boolean-based blind (content/length difference):
uid=0' OR 1=1 -- -
Verified environment: Apache 2.4.39 / PHP 7.3.4 / MySQL ≥ 5.0.12
Impact:
- High confidentiality risk: attackers with an admin session can infer and extract sensitive database contents (e.g., users table: names, emails, contact numbers, registration dates).
- Moderate integrity risk through potential chaining with other admin-side injection points.
- Availability impact is low.
Remediation:
- Validate uid as an integer (e.g., ctype_digit + cast to int) and use prepared statements (SELECT * FROM users WHERE id = ?).
- Enforce server-side input validation and least-privilege DB credentials; consider output encoding for UI rendering.
Non-duplication note:
This issue specifically targets v3.3’s /admin/user-profile.php (uid, GET, admin-authenticated). It is distinct from previously disclosed injections in other endpoints (e.g., admin login handler or search-result.php) and no public CVE was found for this endpoint/version combination. |
|---|
| Nguồn | ⚠️ https://github.com/romatdibrohiksnov/vulndb.com/blob/main/PHPGurukul%20User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20Admin%20Panel%20v3.3%20Authenticated%20SQL%20Injection%20in%20adminuser-profile.php%20(uid)%20.md |
|---|
| Người dùng | px_kanten (UID 90960) |
|---|
| Đệ trình | 25/09/2025 10:43 (cách đây 1 Năm) |
|---|
| Kiểm duyệt | 27/09/2025 19:17 (2 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 316238 [PHPGurukul User Registration & Login and User Management System /admin/user-profile.php Tiêm SQL] |
|---|
| điểm | 0 |
|---|