| 标题 | code-projects Online Examination System in PHP unknown sql |
|---|
| 描述 | Multiple scripts within the "Online Examination System in PHP" perform SQL queries by directly concatenating unsanitized user input into SQL statements (notably in `login.php`, `login_admin.php`, `add_user.php`, and `addmembers.php`). User-supplied fields such as `username`, `password`, and other form parameters are used verbatim in queries like `SELECT ... WHERE username='$username' AND password='$password'` and direct INSERT statements, allowing an attacker to inject SQL payloads.
Successful exploitation can result in authentication bypass, disclosure of sensitive data (including user passwords stored in plaintext), modification or deletion of database records, and full database compromise depending on the database privileges. The vulnerability is present in both authentication and data-entry routes (login forms and user/member creation endpoints). |
|---|
| 用户 | imcoming (UID 95032) |
|---|
| 提交 | 2026-01-30 11時09分 (9 月前) |
|---|
| 管理 | 2026-02-07 15時54分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 344874 [code-projects Online Examination System 1.0 login.php username/password SQL注入] |
|---|
| 积分 | 17 |
|---|