Summary

SourceCodester Testimonial Page Manager 1.0 builds a SQL query in delete-testimonial.php using the testimony GET argument without sanitizing it. A remote attacker can inject SQL with no authentication. NVD scores it 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Details

The testimony value is concatenated into the query that handles deletions. Because it is never bound as a parameter or type-checked, an attacker can end the intended statement and add their own SQL. The endpoint is reachable over the network and needs no login.

Impact

An attacker can read or alter data in the application database. With a sufficiently privileged database account, this can extend toward control of the host.

Remediation

No fixed release exists for this 1.0 project. Use prepared statements for the deletion query and validate testimony as an integer.

References