| tiêu đề | Github pearProject <=V2.8.10 SQL Injection |
|---|
| Mô tả | PearProject is a front-end and back-end separated management system. The $projectCode parameter of the dateTotalForProject method in the Task.chp file under the backend interface of the project management system is controllable by the user and directly passed to the dateTotalForProject function; Tracking dateTotalForProject to the application/common/Model/Task. php file, it can be seen that the $projectCode in the dateTotalForProject method is directly concatenated without any filtering. Attackers can construct malicious SQL statements to obtain sensitive information. |
|---|
| Nguồn | ⚠️ https://github.com/XiaoyuZhou1997/CVE/issues/1 |
|---|
| Người dùng | 319398761 (UID 95561) |
|---|
| Đệ trình | 13/02/2026 08:10 (cách đây 5 các tháng) |
|---|
| Kiểm duyệt | 23/02/2026 19:04 (10 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 347413 [a54552239 pearProjectApi đến 2.8.10 Backend Interface Task.php dateTotalForProject projectCode Tiêm SQL] |
|---|
| điểm | 20 |
|---|