Critical Vulnerability Information Affected Product Product Name: Company Visitors Management System Project V2.0 Vendor Homepage: https://phpgurukul.com/company-visitor-management-system-using-php-and-mysql/ Vulnerable File and Version Vulnerable File: /admin-profile.php Affected Version: V2.0 Vulnerability Type Type: SQL Injection Root Cause In the file, malicious code is injected via the parameter. This input is directly used in SQL queries without proper validation or filtering. Impact Exploiting this SQL injection vulnerability allows attackers to access the database without authorization, steal data, take control of the system, or even disrupt services. Description During a security assessment of the "Company Visitors Management System", a critical SQL injection vulnerability was identified in the file. The vulnerability arises from insufficient validation of user input. Vulnerability Details and POC Vulnerable Location: parameter Payload: - Parameter: Multipart/form-data (custom POST) - Type: Time-based Blind SQL Injection AND Time-based Blind (using SLEEP) - Payload: ...geckoforBoundaryYiaaD976e043a8f177d4542f5bdc200... Request Packet: - POST /cms/admin-profile.php HTTP/1.1 - Host: 192.168.1.100 - Content-Type: multipart/form-data; boundary=...geckoforBoundaryYiaaD976e043a8f177d4542f5bdc200... Recommended Remediation 1. Use prepared statements with parameter binding. 2. Implement input validation and filtering. 3. Minimize database user privileges.