| tiêu đề | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c |
|---|
| Mô tả | The affected component is `admin/add_menu.php`, an authenticated endpoint that inserts a new food item into the `menu` table. The endpoint concatenates the user-controlled POST parameters `item`, `price`, `image`, and `type` directly into a SQL `INSERT` statement without any escaping or parameterization:
```php
$dst1= $_POST['image'];
mysqli_query($conn,"insert into menu values('','$_POST[item]','$_POST[price]','$dst1','$_POST[type]')");
```
The `submit` parameter is also checked against the string `"Insert into menu"`, but no authentication, role check, anti-CSRF token, or input validation is enforced. Because the fields are interpolated into the query verbatim, an attacker can close the row's `VALUES (...)` clause, append a second `VALUES (...)` row using `-- -` or `#` to comment out the trailing junk, and freely insert attacker-controlled rows. This primitive was used in the lab to insert arbitrary rows into the `menu` table. With MySQL `SELECT ... INTO OUTFILE` (or stacked statements in some PHP/MySQL builds) the same flaw can be escalated to file write or remote code execution. Combined with the missing role check on admin pages (see CVE-12), the vulnerability is exploitable by any logged-in user. |
|---|
| Nguồn | ⚠️ https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/2 |
|---|
| Người dùng | mangguoli (UID 100823) |
|---|
| Đệ trình | 26/08/2026 18:23 (cách đây 25 ngày) |
|---|
| Kiểm duyệt | 19/09/2026 23:19 (24 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 407970 [AdithyaYelloju Restaurant-Management-System đến 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c admin/add_menu.php item/price/image/type Tiêm SQL] |
|---|
| điểm | 20 |
|---|