| 标题 | PHPGurukul Online Course Registration System ≤ 3.1 SQL Injection |
|---|
| 描述 | A critical SQL Injection vulnerability was discovered in PHPGurukul Online Course Registration System v3.1. The vulnerability exists in the file /onlinecourse/admin/manage-students.php, where the id GET parameter is directly concatenated into SQL queries without any input validation or sanitization. This affects the student deletion and password reset functions. An authenticated attacker can inject malicious SQL commands to extract sensitive data, delete records, or compromise the database. |
|---|
| 来源 | ⚠️ https://note-hxlab.wetolink.com/share/Tma34bofeB2L |
|---|
| 用户 | angelkate (UID 94159) |
|---|
| 提交 | 2026-01-07 07時06分 (9 月前) |
|---|
| 管理 | 2026-01-09 10時40分 (2 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 340130 [PHPGurukul Online Course Registration System 直到 3.1 manage-students.php id/cid SQL注入] |
|---|
| 积分 | 0 |
|---|