| tiêu đề | PHPGurukul User Registration & Login and User Management System With admin panel 3.3 Injection |
|---|
| Mô tả | Web applications must never concatenate untrusted input into SQL queries and should always use parameterized queries or prepared statements to prevent injection. However, during the security review it was found that the fname parameter in the authenticated POST request to edit-profile.php?uid=1 is used directly in a backend query without proper parameterization or input validation, allowing SQL payloads to manipulate query logic — this was confirmed and exploited with sqlmap to enumerate the DBMS and dump data. This vulnerability enables confidential data disclosure (emails, password hashes), authentication bypass or data tampering, and significantly increases the attack surface by allowing an attacker with a valid session (or a coerced victim) to exfiltrate or modify sensitive database contents. |
|---|
| Nguồn | ⚠️ https://github.com/r4vindra/User-Registration-Login-and-User-Management-System-With-admin-panel/blob/main/CSRF%20and%20SQL%20Injection.md |
|---|
| Người dùng | r4vindra (UID 91109) |
|---|
| Đệ trình | 04/10/2025 13:45 (cách đây 12 các tháng) |
|---|
| Kiểm duyệt | 08/10/2025 16:50 (4 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 309496 [PHPGurukul User Registration & Login and User Management System /edit-profile.php Tiêm SQL] |
|---|
| điểm | 0 |
|---|