SQL Injection Vulnerability in Daily Expenses Management System by PHP Gurukul

CVE-2024-29390

Summary

The Daily Expenses Management System version 1.0, developed by PHP Gurukul, is susceptible to a time-based blind SQL injection on the 'add-expense.php' page. An attacker can exploit this vulnerability by manipulating the 'item' parameter in a POST request, allowing them to execute arbitrary SQL commands on the backend database. By injecting specifically crafted SQL queries that induce time delays in database operations, attackers can confirm the presence of this vulnerability based on the observable lag in server response times.

References