提交 #992656: KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection

The affected components are `student_signup.php` and `teacher_signup.php` (repository root). Both files read the registration form values and interpolate them into a SELECT that is supposed to verify that the registering user already exists, and then into an UPDATE that (re)sets the password of the matched row:

```php
// student_signup.php
$query = mysql_query("select * from student where username='$username' and firstname='$firstname' and lastname='$lastname' and class_id = '$class_id'")or die(mysql_error());
$id = $row['student_id'];
if ($count > 0){
mysql_query("update student set password = '$password', status = 'Registered' where student_id = '$id'")or die(mysql_error());
$_SESSION['id']=$id;
echo 'true';
}
```

```php
// teacher_signup.php
$query = mysql_query("select * from teacher where firstname='$firstname' and lastname='$lastname' and department_id = '$department_id'")or die(mysql_error());
$id = $row['teacher_id'];
if ($count > 0){
mysql_query("update teacher set username='$username',password = '$password', teacher_status = 'Registered' where teacher_id = '$id'")or die(mysql_error());
$_SESSION['id']=$id;
echo 'true';
}
```

Injecting `' OR 1=1 -- -` into `firstname` makes the SELECT match an arbitrary existing row; the UPDATE then overwrites that account's password (and for teachers also the username) with the attacker's chosen values. Because these endpoints require no authentication and no CSRF token, an anonymous attacker can take over any student or teacher account whose row can be matched, then log in normally with the new password. The write primitive also allows mass password resets (for example `' OR '1'='1`) across the whole table.

• 来源: ⚠️ https://github.com/KusalkaSilva/Learning-Management-System/issues/3
• 用户: vuldb2026 (UID 101467)
• 提交: 2026-09-20 17時22分 (16 日前)
• 管理: 2026-10-06 07時49分 (16 days later)
• 状态: 已接受
• VulDB条目: 413894 [Kusalkasilva Learning-Management-System 直到 ffeb873f8803f1e9664384ff75000c7da45466d2 Student Registration Endpoint student_signup.php SQL注入]
• 积分: 20