| 标题 | Fabian Ros Student File Management System in PHP 1.0 SQL Injection |
|---|
| 描述 | A SQL injection vulnerability exists in the Student File Management System (SFMS) v1.0 within the /admin/save_user.php file, where multiple user-supplied parameters (firstname, lastname, username, status) are directly concatenated into an INSERT SQL query without proper validation or parameterization, allowing authenticated attackers to inject malicious SQL statements through crafted POST requests and potentially manipulate database operations, extract sensitive information, or compromise the integrity of the user management system. |
|---|
| 来源 | ⚠️ https://gist.github.com/b1uel0n3/b1a09a8a69077bf12c0d420621118005 |
|---|
| 用户 | b1uel0n3 (UID 93016) |
|---|
| 提交 | 2025-12-08 15時11分 (10 月前) |
|---|
| 管理 | 2025-12-13 10時02分 (5 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 336307 [code-projects Student File Management System 1.0 /admin/save_user.php firstname SQL注入] |
|---|
| 积分 | 0 |
|---|