PT-2026-29324 · Oretnom23 · Alton Management System

Meifukun · Publicado 2026-03-31 · Atualizado 2026-03-31 · CVE-2026-30520

NVD

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save loan action). The application fails to properly sanitize user input supplied to the "borrower id" parameter in a POST request, allowing an authenticated attacker to inject malicious SQL commands.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-30520

Produtos afetados

Alton Management System

Referências · 2

• 🔥 https://github.com/meifukun/Web-Security-PoCs/blob/main/Loan-Management-System/SQLi-SaveLoan-borrowerId.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30520 · Nota de Segurança