EngineerCMS SQL Injection Vulnerability in Add Project Interface

A SQL injection vulnerability has been identified in EngineerCMS versions 1.02 through 2.0.5. The issue occurs in the '/project/addproject' interface, where specially crafted parameters can be used to manipulate SQL queries. This vulnerability allows for time-based blind SQL injection, exploiting the SQLite database used by the application.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries, potentially leading to unauthorized data access or modification.

Reproduction

To reproduce this vulnerability, log into EngineerCMS and navigate to the '/project/addproject' interface. Once there, send a POST request with a payload that includes a crafted 'name' parameter. This parameter should be designed to exploit the application's SQL query handling, such as by using SQL injection techniques to manipulate the query execution.