| 标题 | code-projects College Notes Uploading System 1.0 (Latest Official Source Code) SQL Injection |
|---|
| 描述 | The College Notes Uploading System developed in PHP has a critical SQL injection vulnerability in the login.php file. The login interface obtains user-controllable user and pass parameters through POST requests and directly splices them into SQL query statements.
The program incorrectly calls mysqli_real_escape_string() function but does not assign the escaped return value to variables, resulting in user input still being raw unsanitary data. Unauthenticated remote attackers can construct malicious SQL payloads to exploit this vulnerability, achieve login authentication bypass, arbitrarily query all database data, obtain user account plaintext passwords and other sensitive information, and cause serious information leakage and system security risks. |
|---|
| 来源 | ⚠️ https://github.com/XOB-Kongqi/SystemCng-SQL-Injection/blob/master/cng_sql.md |
|---|
| 用户 | XOBKONGQI (UID 98315) |
|---|
| 提交 | 2026-05-16 19時51分 (5 月前) |
|---|
| 管理 | 2026-06-04 07時44分 (18 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 338585 [code-projects College Notes Uploading System 1.0 /login.php user SQL注入] |
|---|
| 积分 | 0 |
|---|