| tiêu đề | Yash Pokharna StudentManagementSystem 1.0 SQL Injection |
|---|
| Mô tả | Describe the bug
Two critical issues exist in student_trans.php:
Broken Access Control: The script does not include session.php or call confirm_logged_in(), leaving the endpoint completely unauthenticated. Anyone can access it without a valid session cookie.
SQL Injection: User-supplied POST parameters (FIRST_NAME, Last_Name, EMAIL, etc.) are directly concatenated into an INSERT SQL statement without sanitization or parameterized queries.
An attacker can exploit this to insert arbitrary data (including malicious XSS payloads) into the database, or perform time‑based/error‑based SQL injection. |
|---|
| Nguồn | ⚠️ https://github.com/yashpokharna2555/StudentManagementSystem/issues/3 |
|---|
| Người dùng | Levis1 (UID 96766) |
|---|
| Đệ trình | 27/04/2026 10:44 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 24/05/2026 11:06 (27 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 365451 [yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203 student_trans.php confirm_logged_in FIRST_NAME/Last_Name/EMAIL Tiêm SQL] |
|---|
| điểm | 20 |
|---|