| 标题 | code-projects Online Application System for Admission in PHP unknown SQL Injection |
|---|
| 描述 | A SQL Injection vulnerability exists in the Online Application System for Admission in PHP (code-projects). Several server-side scripts (for example enrollment/index.php, enrollment/adminlogin.php, and enrollment/signupconfirm.php) build SQL statements by directly concatenating user-controlled input into queries without using parameterized queries or proper input sanitization. An attacker can inject crafted SQL payloads into form fields (e.g. login or search inputs) to alter the intended SQL logic, which may allow authentication bypass, unauthorized disclosure of sensitive data, modification or deletion of database records, and escalation of privileges.
Proof-of-Concept (example):
POST to the login endpoint with:
u_id: admin' OR '1'='1
u_ps: anything
If successful, the injected condition (' OR '1'='1) causes the WHERE clause to always evaluate true and may bypass authentication.
Impact:
Authentication bypass (including administrative accounts)
Data exfiltration (sensitive user records)
Data tampering or deletion
Potential lateral movement or further exploitation depending on DB privileges |
|---|
| 用户 | imcoming (UID 95032) |
|---|
| 提交 | 2026-01-30 10時58分 (8 月前) |
|---|
| 管理 | 2026-02-07 15時52分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 344873 [code-projects Online Application System for Admission 1.0 Login Endpoint enrollment/index.php SQL注入] |
|---|
| 积分 | 17 |
|---|