提交 #895608: code-projects Content Management System In PHP 1.0 SQL Injection

The Content Management System in PHP (NEWS-BUZZ) is potentially vulnerable to SQL injection in the user authentication functionality.

The vulnerability affects the user_name parameter processed by the login.php endpoint. During authentication, the application accepts a username and password supplied through an HTTP POST request and uses these values to determine whether the user is authorized to access the management interface.

The user_name parameter appears to be processed by a backend SQL query without sufficient separation between user-controlled data and SQL commands. When a specially crafted value containing a single quotation mark is submitted, the additional SQL metacharacter may interfere with the syntax of the database query.

The supplied test input is:

ZcqnRNHc'
If the application dynamically constructs the login query using string concatenation, the quotation mark can terminate the intended SQL string context. Depending on the surrounding query structure, an attacker may subsequently be able to alter the query's logic or introduce additional SQL expressions.

A vulnerable implementation may conceptually resemble:

$user_name = $_POST['user_name'];
$user_password = $_POST['user_password'];

$query = "SELECT * FROM users
WHERE user_name = '$user_name'
AND user_password = '$user_password'";

$result = mysqli_query($connection, $query);
In this type of implementation, the supplied user_name value becomes part of the SQL command itself instead of being treated strictly as data.

If SQL injection is confirmed, successful exploitation could potentially allow an unauthenticated attacker to interfere with authentication queries, access sensitive database information, enumerate application users, retrieve authentication-related records, or affect stored data depending on the permissions assigned to the application's database account.

Because the vulnerable functionality is located on the application's login page, exploitation may not require an authenticated session.

The underlying cause is improper handling of untrusted input when constructing SQL statements. The application should use prepared statements with parameter binding for all authentication queries.

• 来源: ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20Vulnerability%20in%20Content%20Management%20System%20%60user_name%60%20Parameter.md
• 用户: AhmadMarzook (UID 96211)
• 提交: 2026-07-19 17時20分 (2 月前)
• 管理: 2026-09-05 12時33分 (2 months later)
• 状态: 已接受
• VulDB条目: 399307 [code-projects Content Management System 1.0 /login.php user_name SQL注入]
• 积分: 20