| ଶୀର୍ଷକ | code-projects Blood Bank Management System 1.0 SQL Injection |
|---|
| ବର୍ଣ୍ଣନା | A time-based SQL Injection vulnerability was discovered in the delete request functionality of the BloodBank Management System version 1.0. This vulnerability occurs because the bid parameter is not properly sanitized, allowing an attacker to inject malicious SQL commands into the backend database query.
This attack relies on a blind SQL injection technique, where the attacker uses time-based delays (via the BENCHMARK function) to infer if the injection was successful. If the system delays its response, the attacker knows the SQL query was executed, allowing them to:
Tamper with or delete sensitive records (e.g., blood bank data).
Extract data slowly by chaining multiple queries.
Cause Denial of Service (DoS) by overloading the system with intensive queries. |
|---|
| ଉତ୍ସ | ⚠️ https://gist.github.com/higordiego/bf0cf963ec56cfe0dcaba2956352bafd |
|---|
| ଉପଭୋକ୍ତା | c4ttr4ck (UID 75518) |
|---|
| ଦାଖଲ | 10/25/2024 11:15 PM (1 ବର୍ଷ ago) |
|---|
| ମଧ୍ୟମ ଧରଣର | 10/26/2024 03:43 PM (16 hours later) |
|---|
| ସ୍ଥିତି | ଗ୍ରହଣ କରାଯାଇଛି |
|---|
| VulDB ଏଣ୍ଟ୍ରି | 281958 [code-projects Blood Bank Management System 1.0 /file/delete.php bid SQL ଇଞ୍ଜେକ୍ସନ] |
|---|
| ପଏଣ୍ଟ | 20 |
|---|