Human Resource Management System 1.0

Submitter: Kha Do

Vulnerability

SQL injection

Description

SQL injection vulnerability in /hrm/country.php in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the searccountry parameters.

Affected component

Path URL: /hrm/country.php

Parameter: &searccountry=[inject here]

Impact

This vulnerability allow attackers allow attackers to execute arbitrary SQL commands via the searccountry parameters

POC

When searching country with the incorrect condition ' and '1'='2'#, no results are returned:

And, when searching country with the incorrect condition ' and '1'='1'#, all results are returned: