PHPGurukul Zoo Management System SQL Injection Vulnerability in Login Component

A critical SQL injection vulnerability has been identified in PHPGurukul Zoo Management System version 2.1. The issue resides in the login administration file, specifically within the 'username' parameter. This vulnerability allows remote attackers to inject malicious SQL queries, potentially leading to unauthorized database access, data manipulation, and exposure of sensitive information. The vulnerability arises from inadequate input validation, allowing attackers to exploit SQL query construction without proper sanitization.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate database queries. This could lead to unauthorized data access, data modification or deletion, and in some cases, executing administrative operations on the database.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/admin/login.php' with an injected SQL payload in the 'username' parameter. This can be done using tools like sqlmap, which automates the process of finding and exploiting SQL injection vulnerabilities.

Remediation

It is recommended to implement input validation and use prepared statements to prevent SQL injection. Regular security audits should also be conducted to identify and address potential vulnerabilities.