SQL injection vulnerability in the login part of the index.php file

[EmilGallajov]

Hi, I am egsec. NEW-BUZZ manament system has sql injection vulnerability in the login part. I submitted this vulnerability to the vuldb.com as a CVE-2024-10758 and you can check out below-mentioned links for patching this vulnerability. I recommend that use prepared statement in order to prevent sql injection vulnerability. Do not put the $username variable directly to the SQL query!

reports:
https://www.tenable.com/cve/CVE-2024-10758
https://github.com/EmilGallajov/zero-day/blob/main/content_management_system_sqli.md