Dynamic Input Field Generator Using Html Css And Php
Monthly
SQL injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 exposes the saveUser function at /public/submit.php to database manipulation through the unsanitized Researcher parameter. The CVSS 4.0 score of 5.3 with PR:L indicates low-privileged authentication is required, limiting but not eliminating risk. A public proof-of-concept exploit is available via a referenced GitHub gist, and no vendor-released patch has been identified at time of analysis.
Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.
SQL injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 exposes the saveUser function at /public/submit.php to database manipulation through the unsanitized Researcher parameter. The CVSS 4.0 score of 5.3 with PR:L indicates low-privileged authentication is required, limiting but not eliminating risk. A public proof-of-concept exploit is available via a referenced GitHub gist, and no vendor-released patch has been identified at time of analysis.
Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.