CVE

SQL Injection Vulnerability in itsourcecode Courier Management System V1.0 BUG_Author: liuhanzhi Affected Version: V1.0 Vendor: itsourcecode Software: Courier Management System Vulnerability File: /manage_user.php Description 1. SQL Injection via id Parameter In the file /manage_user.php, the application directly concatenates the user-supplied id parameter into an SQL query without any sanitization or validation. Vulnerable code (line 5): $user = $conn->query("SELECT * FROM users where id =".$_GET['id']); 2. Exploiting the SQL Injection By injecting malicious SQL commands into the id parameter via a GET request, an attacker can manipulate the underlying SQL query to perform unauthorized database operations including data extraction, modification, and enumeration. ...