Headline
CVE-2021-26800: User Management System in PHP using Stored Procedure |User Management System using Stored Procedure - PHPGurukul
Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account.
Project Name
User Management System in PHP Stored Procedure
Language Used
PHP5.6, PHP7.x
Database
MySQL 5.x
User Interface Design
HTML, AJAX,JQUERY,JAVASCRIPT
Web Browser
Mozilla, Google Chrome, IE8, OPERA
Software
XAMPP / Wamp / Mamp/ Lamp (anyone)
Last Updated
02 July 2021
This project is developed in PHP using Stored Procedure.
A stored procedure is a set of SQL commands that have been compiled and stored on the database server.
Once the stored procedure has been “stored”, client applications can execute the stored procedure over and over again without sending it to the database server again and without compiling it again.
Stored procedures improve performance by reducing network traffic and CPU load.
Comparison with dynamic SQL
- Remove overhead
- Avoidance of network traffic
- Encapsulation of business logic
- Delegation of access-rights
- Some protection from SQL injection attacks
This project have two modules
- User Module
- Admin Module
User Modules
- User can signup
- User can log in to the system.
- User Password Recovery
- After login user can edit his/her own profile.
- Change password.
Admin Modules
- Admin can log in to the system.
- Admin Password Recovery.
- After login admin can view the admin dashboard.
- Manage all the user(Update and delete the user profile).
- Change Password.
Stored Procedure used in this Project
User module
- sp_signup (used for user signup)
- sp_checkemailavailabilty (check the email available for registration or not)
- sp_userlogin (used for user login)
- sp_userpwdrecoveryvalidation (used for password recovery user validation)
- sp_userpwdrecoveryvalidation (if user details verified by the above-stored procedure then it will reset the user password)
- sp_userprofile (used to view user profile)
- sp_userupdateprofile (used to update the user profile details) Note: This procedure used in both module
- sp_useremailupdation (used to update user email id) Note: This procedure used in both module
- sp_usercurrentpwdvalidate (used to valid user current password for change password)
- sp_userchangepwd (if the password is validated by the above-stored procedure then this stored procedure used to change the user password)
Admin module
- sp_adminlogin (used for admin login)
- sp_adminpwdrecoveryvalidation (used for password recovery admin validation)
- sp_adminpasswordrecovery (if admin details verfied by above stored procedure then it will reset the admin password)
- sp_adminprofile (used to view admin profile details)
- sp_admindashboard (used for admin dashboard)
- sp_recent15users (used to view the 15 recent registered user at dashboard)
- sp_allregisteredusers (used to view all registered users)
- sp_userdeletion (used to delete user profile)
- sp_userupdateprofile (used to updat the user profile details) Note: This procdure used in both module
- sp_useremailupdation (used to update user email id) Note: This procdure used in both module
- sp_admincurrentpwdvalidate (used to valid admincurrent password for change password)
- sp_adminchangepwd (if the password is validate by above stored procedure then this store used to change the admin password)
How to run the User Management System in PHP Stored Procedure
1.Download the zip file
2.Extract the file and copy ums-sp folder
3.Paste inside root directory(for xampp xampp/htdocs, for wamp wamp/www, for lamp var/www/html)
4.Open PHPMyAdmin (http://localhost/phpmyadmin)
5.Create a database with name umspsdb
6.Import regdb.sql file(given inside the zip package in SQL file folder)
7.Run the script http://localhost/ums-sp
User Credential
Username: [email protected]
Password: Test@123
or Register a new user
Admin Credential
Username: admin
Password: Test@123
View Demo———————————————————————–
UMS in PHP using Stored Procedure
Size: 7.44 MB
Version: V1.0
Anuj Kumar
Hi! I am Anuj Kumar, a professional web developer with 5+ years of experience in this sector. I found PHPGurukul in September 2015. My keen interest in technology and sharing knowledge with others became the main reason for starting PHPGurukul. My basic aim is to offer all web development tutorials like PHP, PDO, jQuery, PHP oops, and MySQL, etc. Apart from the tutorials, we also offer you PHP Projects, and we have around 80+ PHP Projects for you.