31 matches found
CVE-2024-44541
CVE-2024-44541：Inventio Lite v4 中的 SQL 注入漏洞 描述 Inventio Lite v4 在 /action=processlogin 端点存在 SQL 注入（SQLi）漏洞。攻击者可通过 POST 请求中的 username 参数注入任意 SQL 查询，可能导致未授权访问和数据窃取。 漏洞代码 漏洞代码如下： if!isset$SESSION"userid" $user = $POST'username'; $pass = sha1md5$POST'password'; $base = new Database; $con =...
CVE-2018-25201
School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques...
EUVD-2018-21659
Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php with...
EUVD-2018-21661
School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques...
CVE-2018-25201
School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques...
CVE-2018-25201 School Management System CMS 1.0 Admin Login SQL Injection
School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques...
CVE-2018-25201
School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques...
CVE-2018-25201: Improper Neutralization of Special Elements used in an SQL Command
School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques...
PT-2026-28238
School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques...
CVE-2024-44541
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."...
CVE-2023-1130
A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The...
CVE-2024-44541
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."...
CVE-2024-44541
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."...
Inventio Lite SQL注入漏洞
Inventio Lite is a general purpose inventory and sales system. A security vulnerability exists in Inventio Lite v4 and prior versions that stems from vulnerability to SQL injection attacks via the username parameter in /?action=processlogin...
CVE-2024-44541
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."...
CVE-2024-44541
evilnapsis Inventio Lite versions v4 and before are vulnerable to SQL Injection in the /?action=processlogin endpoint. The root cause is the improper neutralization of special elements in the username parameter, which allows attackers to inject arbitrary SQL queries via POST requests. This flaw c...
CVE-2024-44541: Improper Neutralization of Special Elements used in an SQL Command
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."...
PT-2024-31169
Name of the Vulnerable Software and Affected Versions Inventio Lite versions v4 and before Description The issue concerns a SQL Injection vulnerability. It can be exploited via the username parameter in the "/?action=processlogin" API endpoint. There is no information provided about the estimated...
CVE-2023-1130
A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The...
Sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The...