Critical SQL Injection in Smart Parking System PHP (CVSS 9.8)

The following is a summary of key vulnerability information extracted from the webpage screenshot: --- Vulnerability Overview Vulnerability Type: SQL Injection (UNION-based and Time-based Blind) Severity Level: Critical (CVSS v3.1 Score: 9.8) Vulnerability ID: AV-2026–001 Discovery Date: 2026-05-09 Author: Anubhav Verma Affected Application: Smart Parking System in PHP (Version 1.0, source code from code-projects.org) Root Cause: Backend SQL queries directly concatenate user input without sanitization or parameterization; the database runs with root privileges and has FILE permission enabled. Potential Impact: - Database enumeration - Leakage of administrator credentials - Arbitrary file reading (e.g., /etc/passwd) - Complete server compromise --- Scope of Impact Affected Parameters: , , in POST requests Affected Endpoint: Database Permissions: DBA / FILE permissions (allowing reading of arbitrary system files) Potential Consequences: - Full database data leakage - Theft of administrator accounts - Reading of system files (e.g., /etc/passwd) - Exposure of internal user information --- Remediation Steps 1. Use prepared statements and parameterized queries; prohibit direct concatenation of user input. 2. Remove FILE permissions from database users. 3. Avoid running the database as root; adhere to the principle of least privilege. 4. Implement server-side input validation. 5. Deploy WAF rules to intercept SQLi patterns. 6. Conduct regular security audits for all user inputs. Vulnerable Code Example (PHP): --- POC / Exploitation Code Manual Injection Test (Time-based Blind): sqlmap Automated Exploitation: Database Enumeration Results: Administrator Credentials Export: Export Results (partially masked): Arbitrary File Reading (/etc/passwd): Successfully downloaded , confirming the ability to read arbitrary files. --- Disclosure Timeline 2026-05-09: Vulnerability discovered and verified locally. 2026-06-04: Responsible disclosure email sent to vendor (code-projects.org); no response received → Public disclosure. 2026-06-04: Submitted to VulDB / CVE application. --- References Smart Parking System In PHP — code-projects.org CWE-89: Improper Neutralization of Special Elements used in an SQL Command OWASP SQL Injection --- About the Author Anubhav Verma - Security Researcher GitHub: @anubhavv106 LinkedIn: linkedin.com/in/anubhav-verma-7123a1232 --- > ⚠️ Actual credentials and content have been redacted and are not publicly disclosed.

Goal Reached Thanks to every supporter — we hit 100%!

Critical SQL Injection in Smart Parking System PHP (CVSS 9.8)