SourceCodester/jkev Record Management System Login index.php SQL 注入漏洞

在 SourceCodester/jkev Record Management System 1.0 版本中检测到 SQL 注入漏洞。此漏洞影响了登录组件中 index.php 文件中的未知功能。对 Username 参数的操作允许攻击者注入恶意 SQL 代码。由于利用可以远程执行，因此风险很高。漏洞的严重程度评分为 CVSS 7.3，表明风险较高。漏洞利用程序的公开披露增加了攻击的可能性，并迫切需要解决此漏洞。

Organizations using the jkev Record Management System, particularly those hosting the application on shared hosting environments or without robust security controls, are at increased risk. Systems with default configurations or weak password policies are especially vulnerable.

• php: Examine web server access logs for suspicious requests targeting index.php with unusual characters in the Username parameter. Use grep to search for patterns indicative of SQL injection attempts.

grep 'username=.*;' /var/log/apache2/access.log

• generic web: Use curl to test the login endpoint with various payloads designed to trigger SQL injection errors.

curl -X POST -d "username='; DROP TABLE users;--" http://your-record-management-system/index.php

• database (mysql): If database access is possible, check for unusual database activity or unauthorized table modifications using MySQL CLI.

mysql -u root -p -e "SHOW TABLES;"

1. 2026-04-05Disclosure

   disclosure

1. 已保留2026-04-04
2. 发布日期2026-04-05
3. 修改日期2026-04-07
4. EPSS 更新日期2026-04-13

目前，开发人员尚未为此漏洞提供官方修复程序。最有效的即时缓解措施是禁用或限制对 SourceCodester/jkev Record Management System 的访问，直到发布安全更新为止。强烈建议对源代码进行彻底的安全审计，以识别和修复 SQL 注入漏洞。实施额外的安全措施，例如验证和清理所有用户输入，可以帮助防止未来的 SQL 注入攻击。监控系统日志以查找可疑活动对于检测和响应潜在攻击也很重要。