Executive brief
The Record Management System, a software used for managing personnel records, contains a security flaw in its login and search functions. An attacker can exploit this to bypass the login screen without a valid password, potentially gaining full access to sensitive employee data and administrative controls. This could lead to the theft of personal information or unauthorized modification of records.
Technical details
A SQL injection vulnerability exists in SourceCodester Record Management System 1.0 due to improper sanitization of user-supplied input in index.php and search_user.php. The application uses direct string concatenation for SQL queries, specifically affecting the 'Username' parameter during login and the 'search' parameter in the user management module. A remote, unauthenticated attacker can exploit this by sending specially crafted POST requests to bypass authentication (e.g., using 'OR 1=1' logic) or perform UNION-based and time-based blind injections to extract database contents. Public exploit code (PoC) is available. Mitigation requires migrating to prepared statements with parameterized queries.
Affected products
- SourceCodester Record Management System 1.0
- jkev Record Management System 1.0
Timeline
- 2026-04-05: disclosed
- 2026-04-05: advisory