School Management System SQL Injection Vulnerability in Admin Login

A SQL injection vulnerability has been identified in the School Management System CMS version 1.0, specifically within the admin login feature. This vulnerability allows attackers to bypass authentication by injecting SQL code through the username parameter. Exploitation involves using boolean-based blind SQL injection techniques on the processlogin endpoint to gain unauthorized access as an administrator.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling attackers to log in as administrators without valid credentials.

Reproduction

To reproduce this vulnerability, send a POST request to the processlogin endpoint with the username parameter injected with malicious SQL payloads that exploit boolean-based blind SQL injection. The injection can be crafted to manipulate the SQL query processing, bypassing authentication checks.