| tiêu đề | Mstfakts College-Management-System 82ab01d057d96c8893c419cd9cb6870120faaea3 SQL Injection |
|---|
| Mô tả | The affected components are `Front-end/university.php:117-140` and `Front-end/faculty.php:114-138`. Each unauthenticated book-search handler inserts the attacker-controlled `book_name` and `book_author` POST parameters directly into a SQL statement and executes it with `mysqli_query()`:
```php
$name=$_POST['book_name'];
$author=$_POST['book_author'];
$query = "SELECT * FROM book WHERE book_name = '$name' AND author = '$author'";
$results = mysqli_query($db, $query);
```
Neither endpoint validates nor parameterizes the values, and neither enforces an authenticated session before reaching the query. A remote attacker can use a four-column `UNION SELECT` to read arbitrary database rows. The returned columns are written into the HTML result table, allowing disclosure of account records, password hashes, phone numbers, and role data from the `visitor` table. The same primitive can be adapted to enumerate other accessible tables and records. |
|---|
| Nguồn | ⚠️ https://github.com/Mstfakts/College-Management-System/issues/5 |
|---|
| Người dùng | Yangqiangfeng (UID 98164) |
|---|
| Đệ trình | 20/07/2026 11:03 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 05/09/2026 20:59 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 399349 [Mstfakts College-Management-System Search Front-end/university.php mysqli_query book_name/book_author Tiêm SQL] |
|---|
| điểm | 20 |
|---|