| 标题 | code-projects Interview Management System in PHP 1.0 SQL Injection |
|---|
| 描述 | A SQL Injection vulnerability exists in the report viewing functionality of Interview Management System in PHP version 1.0.
The endpoint viewReport.php passes the GET parameter id to two methods in the View class. In both cases, $candId is directly concatenated into the SQL query string before being sent to PDO's prepare(). Because the user-controlled value is embedded in the query string prior to preparation, PDO's parameterization offers no protection:
In View::viewReport() (inc/classes/View.php):
function viewReport(){
$candId = $_GET['id'];
$sql = "select * from questions, reports, candidates where reports.cand_id = candidates.cand_id and reports.question_id = questions.question_id and reports.cand_id = $candId";
$query = $this->db->simplequerywithoutcondition($sql);
In View::viewReportComment() (inc/classes/View.php):
function viewReportComment(){
$candId = $_GET['id'];
$sql = "select * from comments where comments.cand_id = $candId";
$query = $this->db->simplequerywithoutcondition($sql);
Both SELECT queries join multiple tables and expose full row data from questions, reports, candidates, and comments tables. An attacker with valid credentials can use UNION-based injection to extract data from any other table in the database, including the user table containing login credentials. |
|---|
| 来源 | ⚠️ https://gist.github.com/c4ttr4ck/96ea33a23b47467051314fa704379336 |
|---|
| 用户 | c4ttr4ck (UID 75518) |
|---|
| 提交 | 2026-06-02 20時21分 (1 月前) |
|---|
| 管理 | 2026-07-03 20時33分 (1 month later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 205667 [SourceCodester Interview Management System 1.0 /viewReport.php 标识符 SQL注入] |
|---|
| 积分 | 0 |
|---|