ScriptAndTools Real-Estate-Website-in-PHP SQL Injection Vulnerability in Admin Login Panel

A critical SQL injection vulnerability has been identified in ScriptAndTools Real-Estate-Website-in-PHP version 1.0. The issue resides in the Admin Login Panel, specifically within the '/admin/' directory. The vulnerability allows remote exploitation by manipulating the 'Password' argument, bypassing authentication and potentially leading to unauthorized access and data breaches.

Impact

Exploitation of this vulnerability allows for SQL injection, which can be used to bypass authentication, access and manipulate database information, and potentially execute administrative functions within the application.

Reproduction

To reproduce this vulnerability, navigate to the '/admin/' login page. In the username and password fields, enter SQL injection payloads such as 'or 1=1 limit 1 -- -'. This will bypass the login authentication and grant access to the admin panel.