SQLI vulnerabilities
After checking CVE-2020-25273
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25273
We found the reason that.
there is the extract function in the file "login_auth.php". which will generate variables from the $_POST and these variables will pass to the DB without sanitizing.
After checking the whole project. There 49 vulnerable variables pass to to the DB. with 12 function extract($_POST); and 20 different sinks (DB query).
The affected files (each file has one source and one or more sinks).
1) bus_booking\book_now.php
2) bus_booking\delete_bus.php
3) bus_booking\delete_location.php
4) bus_booking\delete_schedule.php
5) bus_booking\delete_user.php
6) bus_booking\load_schedule2.php
7) bus_booking\login_auth.php (CVE-2020-25273)
8) bus_booking\save_bus.php
9) bus_booking\save_location.php
10) bus_booking\save_schedule.php
11) bus_booking\save_user.php
12) bus_booking\update_account.php
