PHPGurukul Boat Booking System SQL Injection Vulnerability in Add Boat Admin File

A critical SQL injection vulnerability has been identified in PHPGurukul Boat Booking System version 1.0. The issue arises in the admin add-boat.php file, where the boatname parameter is manipulated to inject malicious SQL queries. This vulnerability can be exploited remotely, without any authentication, allowing attackers to access, modify, or delete database information.

Impact

Exploitation of this vulnerability allows for unauthorized database access, manipulation of data, and potential disruption of services.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /admin/add-boat.php file with a crafted boatname parameter. This parameter should include a payload that exploits the SQL injection, such as a time-based blind injection that uses a SQL sleep command to demonstrate the vulnerability.

Remediation

No specific remediation is known for this vulnerability.