Fanli2012 Native-PHP-CMS SQL Injection Vulnerability in Login Functionality

A critical SQL injection vulnerability has been identified in Fanli2012 native-php-cms version 1.0. The issue arises in the login administration file, specifically '/fladmin/login.php', where the 'username' parameter can be manipulated to execute malicious SQL commands. This vulnerability can be exploited remotely, without any authentication requirements.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, navigate to the '/fladmin/login.php' page. In the username field, enter a crafted SQL injection payload that exploits the application's SQL query handling. The password field can be left arbitrary or filled with a simple value like '1'.