search

vish07 / WackoPicko

WackoPicko is a vulnerable web application used to test web application vulnerability scanners.
MIT License
0 stars 0 forks source link

CX SQL_Injection @ website/admin/login.php [master] #46

Open vish07 opened 4 years ago

vish07 commented 4 years ago

SQL_Injection issue exists @ website/admin/login.php in branch master

Method <?php at line 1 of website\admin\login.php gets user input from the _POST element. This element’s value then flows through the code without being properly sanitized or validated, and is eventually used in a database query in method login_admin at line 57 of website\include\admins.php. This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 10

Code (Line #10):

   if ($user = Admins::check_login($_POST['adminname'], $_POST['password']))
vish07 commented 4 years ago

Issue still exists.

vish07 commented 4 years ago

Issue still exists.