| Package | Affected versions | Patched versions |
|---|---|---|
| daily expenses management system | = 1.0 |
Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done by injecting specially crafted SQL queries that make the database perform time-consuming operations, thereby confirming the presence of the SQL injection vulnerability based on the delay in the server's response.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free