PHPGurukul Billing System SQL Injection Vulnerability in Password Recovery Endpoint

A SQL injection vulnerability has been identified in PHPGurukul Billing System version 1.0, specifically within the admin password recovery endpoint. The vulnerability arises because the username and mobileno parameters accept unvalidated user input, which is directly concatenated into a backend SQL query without proper sanitation or parameterization. This flaw allows attackers to manipulate the SQL query executed by the database, potentially leading to unauthorized data access, account takeover, or modification of the application's database.

Impact

Exploitation of this vulnerability could allow a remote attacker to bypass authentication, access unauthorized data from the database, or compromise the integrity of the entire application's database.