Vulnerability Type: SQL Injection Vulnerable File: /signupscript.php Root Cause: The POST parameter is concatenated directly into the SQL query without sanitization or validation. Authentication Required: None – exploitable remotely and anonymously Impact: Unauthorized database access, data leakage, alteration or deletion, full system compromise, denial of service Proof-of-Concept: - Error-based SQL injection - Time-based blind SQL injection Verification Tool: sqlmap Verification Command: Detected Vulnerability: - SQLMap identified the Fname parameter as MySQL 5.0.12 RLIKE time-based blind injectable - Back-end DBMS is MySQL - Web application technology: Nginx 1.25.2, PHP 7.4.33 - Back-end DBMS: MySQL >= 5.1