| 标题 | SourceCodester Human resource management system 1.0 SQL Injection |
|---|
| 描述 | A SQL Injection vulnerability was identified in the login functionality of the Human Resources Management System version 1.0. The application fails to properly sanitize user-supplied input before processing SQL queries.
An attacker can exploit this vulnerability by injecting crafted SQL statements into the authentication parameters, allowing the login mechanism to be bypassed without valid credentials. Successful exploitation results in unauthorized access to the administrative dashboard and privileged functionality.
The vulnerability affects the confidentiality, integrity, and availability of the application. An attacker with administrative access may be able to view, modify, or delete sensitive employee records, organizational information, and other restricted data.
The issue can be exploited remotely without requiring prior authentication. The attack complexity is low because only a specially crafted login request is required. This vulnerability may lead to privilege escalation, unauthorized data access, data manipulation, and complete compromise of the affected application.
Vendor notification was performed prior to public disclosure. Additional technical details, proof-of-concept information, and screenshots are available in the referenced advisory. |
|---|
| 来源 | ⚠️ https://medium.com/@hemantrajbhati5555/sql-injection-authentication-bypass-leading-to-unauthorized-admin-access-in-human-resource-bc6121cf6320 |
|---|
| 用户 | Hemant Raj Bhati (UID 95613) |
|---|
| 提交 | 2026-06-21 16時50分 (4 月前) |
|---|
| 管理 | 2026-08-07 10時41分 (2 months later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 213799 [SourceCodester Human Resource Management System 1.0 login.php name/password SQL注入] |
|---|
| 积分 | 0 |
|---|