| tiêu đề | SourceCodester Performance Indicator System 1.0 SQL Injection |
|---|
| Mô tả | During a security review of SourceCodester Performance Indicator System V1.0, a SQL injection vulnerability was identified in the category parameter of /opils/admin/view_product.php.
The value is used directly in an SQL WHERE clause without prepared statements, type validation, or escaping. Although the file is located under the admin directory, its authorization check only verifies that a session exists and does not verify the user's role. As a result, a low-privilege Dealer can reach and exploit the query.
sqlmap identified boolean-based blind, time-based blind, and UNION query injection. A manual UNION request also extracted usernames and plaintext passwords from the application database. A separate injected SLEEP(3) condition delayed the response for approximately three seconds. |
|---|
| Nguồn | ⚠️ https://github.com/OnlyCMJB/cve/issues/4 |
|---|
| Người dùng | OnlyCMJB (UID 100094) |
|---|
| Đệ trình | 21/09/2026 16:27 (cách đây 15 ngày) |
|---|
| Kiểm duyệt | 06/10/2026 10:26 (15 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 413926 [SourceCodester Performance Indicator System 1.0 view_product.php category Tiêm SQL] |
|---|
| điểm | 20 |
|---|