| 标题 | PHPGurukul User Registration & Login and User Management System V3.3 V3.3 SQL Injection |
|---|
| 描述 | An authenticated SQL Injection (CWE-89) exists in “User Registration & Login and User Management System With Admin Panel” v3.3 at /loginsystem/admin/user-profile.php. The GET parameter uid is concatenated directly into a SQL string without validation or parameterization, enabling both boolean-based and time-based blind injection.
Vulnerable code (example):
$userid = $_GET['uid'];
$query = mysqli_query($con, "select * from users where id='$userid'");
Reproduction (after logging into the admin panel):
- Time-based blind (observe a ~5s delay):
uid=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))x)-- -
- Boolean-based blind (content/length difference):
uid=0' OR 1=1 -- -
Verified environment: Apache 2.4.39 / PHP 7.3.4 / MySQL ≥ 5.0.12
Impact:
- High confidentiality risk: attackers with an admin session can infer and extract sensitive database contents (e.g., users table: names, emails, contact numbers, registration dates).
- Moderate integrity risk through potential chaining with other admin-side injection points.
- Availability impact is low.
Remediation:
- Validate uid as an integer (e.g., ctype_digit + cast to int) and use prepared statements (SELECT * FROM users WHERE id = ?).
- Enforce server-side input validation and least-privilege DB credentials; consider output encoding for UI rendering.
Non-duplication note:
This issue specifically targets v3.3’s /admin/user-profile.php (uid, GET, admin-authenticated). It is distinct from previously disclosed injections in other endpoints (e.g., admin login handler or search-result.php) and no public CVE was found for this endpoint/version combination. |
|---|
| 来源 | ⚠️ https://github.com/romatdibrohiksnov/vulndb.com/blob/main/PHPGurukul%20User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20Admin%20Panel%20v3.3%20Authenticated%20SQL%20Injection%20in%20adminuser-profile.php%20(uid)%20.md |
|---|
| 用户 | px_kanten (UID 90960) |
|---|
| 提交 | 2025-09-25 10時43分 (1 年前) |
|---|
| 管理 | 2025-09-27 19時17分 (2 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 316238 [PHPGurukul User Registration & Login and User Management System /admin/user-profile.php SQL注入] |
|---|
| 积分 | 0 |
|---|