Overview
CVE-2026-5179 describes a SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0 where the Username parameter in the admin/login.php endpoint can be manipulated to alter the SQL query (CWE-89, CWE-74). While this CVE targets a PHP application, the underlying vulnerability is universal: if user input is interpolated into SQL without proper parameter binding, remote attackers can craft input to reveal data, bypass authentication, or corrupt data. In Go with Gin, similar risk arises when building SQL statements by concatenating strings or injecting user data into query strings. This guide references CVE-2026-5179 to anchor the risk in real-world examples and shows how to fix such patterns in Go services using parameterized queries and input validation.
In practice, an attacker could supply a crafted username that changes the intended query logic. For example, in the cited PHP app, this could bypass login. In a Go Gin service mirroring that pattern, the attacker could access or exfiltrate data by altering the WHERE clause or other parts of a query. By enforcing separation between data and code via prepared statements and by validating and constraining user inputs, developers can eliminate this class of vulnerability. The fix patterns emphasize using placeholders, binding parameters, and validating inputs-standard defenses against CWE-89 and related SQL injection flaws in Go.
The guide demonstrates a concrete remediation approach for Go (Gin) projects, including how to rewrite vulnerable code to use parameterized queries, how to validate inputs, and how to error-handle securely to avoid leaking DB internals to clients.
Code Fix Example
Go (Gin) API Security Remediation
Vulnerable pattern:
```go
package main
import (
"database/sql"
"log"
"net/http"
"github.com/gin-gonic/gin"
_ "github.com/go-sql-driver/mysql"
)
var db *sql.DB
func main() {
var err error
db, err = sql.Open("mysql", "user:password@tcp(localhost:3306)/testdb")
if err != nil { log.Fatal(err) }
defer db.Close()
r := gin.Default()
r.POST("/login", login)
r.Run(":8080")
}
func login(c *gin.Context) {
username := c.PostForm("username")
// vulnerable: direct string concatenation used to build SQL
query := "SELECT id FROM users WHERE username = '" + username + "'"
row := db.QueryRow(query)
var id int
if err := row.Scan(&id); err != nil {
c.JSON(401, gin.H{"error": "invalid credentials"})
return
}
c.JSON(200, gin.H{"id": id})
}
```
Fix:
```go
package main
import (
"database/sql"
"log"
"github.com/gin-gonic/gin"
_ "github.com/go-sql-driver/mysql"
)
var db *sql.DB
func main() {
var err error
db, err = sql.Open("mysql", "user:password@tcp(localhost:3306)/testdb")
if err != nil { log.Fatal(err) }
defer db.Close()
r := gin.Default()
r.POST("/login", login)
r.Run(":8080")
}
func login(c *gin.Context) {
username := c.PostForm("username")
// safe: use parameterized query to prevent injection
query := "SELECT id FROM users WHERE username = ?"
row := db.QueryRow(query, username)
var id int
if err := row.Scan(&id); err != nil {
c.JSON(401, gin.H{"error": "invalid credentials"})
return
}
c.JSON(200, gin.H{"id": id})
}
```