SourceCodester AC Repair and Services System SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in SourceCodester AC Repair and Services System version 1.0. The issue arises in the 'save_users' function within the '/classes/Users.php' file, where improper handling of the 'ID' argument allows for SQL injection. This vulnerability can be exploited remotely, without authentication.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries, potentially leading to unauthorized data access or modification.

Reproduction

The vulnerability can be reproduced by sending a request to the 'save_users' function in the '/classes/Users.php' file, with a crafted 'ID' argument that exploits the SQL injection flaw. Vulnerable targets can be found using Google Hacking by searching for 'inurl:classes/Users.php'.