Chaitak-Gorai Blogbook SQL Injection Vulnerability in POST Parameter

A critical SQL injection vulnerability has been identified in the Chaitak-Gorai Blogbook application, specifically in versions up to commit 92f5cf90f8a7e6566b576fe0952e14e1c6736513. The issue arises in the 'post.php' file, where user-supplied input from the 'p_id' GET parameter is improperly sanitized before being incorporated into SQL queries. This vulnerability allows remote, unauthenticated attackers to inject and execute arbitrary SQL commands, potentially leading to unauthorized access to, modification of, or further compromise of the database.

Impact

Exploitation of this vulnerability allows for arbitrary SQL injection, which could be used to manipulate database queries, access or modify database information, or execute administrative operations on the database.