Code-Projects Staff Audit System SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in Code-Projects Staff Audit System version 1.0. The issue arises in the login.php file, where the User argument can be manipulated to execute SQL injection attacks. This vulnerability can be exploited remotely, without any authentication requirements.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data modification, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the login.php file with a crafted User argument that includes SQL injection payloads. The absence of authentication requirements allows for remote exploitation.