SourceCodester Apartment Visitor Management System SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in SourceCodester Apartment Visitor Management System version 1.0. The issue arises in the file profile.php, where the mobilenumber parameter can be manipulated to execute malicious SQL commands. This vulnerability can be exploited remotely without authentication, potentially leading to unauthorized data access or manipulation.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the profile.php file with a crafted mobilenumber parameter that includes SQL injection payloads. The absence of authentication requirements allows for easy exploitation.