| 标题 | Fabian Ros Student File Management System in PHP 1.0 SQL Injection |
|---|
| 描述 | A SQL injection vulnerability exists in the Student File Management System (SFMS) v1.0 within the /admin/save_student.php file, where the stud_no, firstname, lastname, gender, year, and section POST parameters are directly concatenated into an INSERT SQL query without proper validation or parameterization, allowing authenticated attackers to inject malicious SQL statements through crafted HTTP requests, potentially leading to unauthorized data manipulation, information disclosure, or full compromise of the student records database. |
|---|
| 来源 | ⚠️ https://gist.github.com/b1uel0n3/093b746e083d8d08576c0cd931f59b58 |
|---|
| 用户 | b1uel0n3 (UID 93016) |
|---|
| 提交 | 2025-12-08 15時18分 (10 月前) |
|---|
| 管理 | 2025-12-13 10時02分 (5 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 336365 [code-projects Student File Management System 1.0 /admin/save_student.php stud_no SQL注入] |
|---|
| 积分 | 0 |
|---|