DevaslanPHP Project Management CVE-2026-100898

Requires an authenticated session on the project-management application (PR:L) with access to the Timesheet Dashboard component; the attacker manipulates the filter argument consumed by the whereRaw() call in app/Filament/Widgets/Timesheet/ActivitiesReport.php. Exploitation is remote over the network with no user interaction and low complexity, but is limited by the need for valid low-privilege credentials and access to the Timesheet reporting widget. Affected versions are 1.2.1 through 1.2.4 and 2.0.0-beta1; no patched release is confirmed since the vendor did not respond.

This is a classic VulDB-sourced disclosure for an obscure open-source PHP project, and the signals are mixed. The vendor CVSS 4.0 base score is only 2.1, driven by PR:L (authenticated) and low VC/VI/VA impact ratings - but that impact rating almost certainly understates a genuine CWE-89 SQL injection. Injection into a whereRaw() clause via the Timesheet Dashboard filter argument permits WHERE-clause manipulation, which typically enables boolean/UNION-based extraction of arbitrary database contents (credentials, session data, PII), so a confidentiality impact of C:H is more defensible than the vendor's VC:L. Countervailing signals keep real-world priority LOW: EPSS is not provided, there is no CISA KEV listing (not actively exploited), the flaw requires authentication (PR:L), and the affected product is a niche GitHub project with negligible enterprise footprint. A public POC does exist (GitHub dddwmr), which raises opportunistic risk for exposed instances, but POC availability is not the same as active exploitation. Net: a technically real, easily-triggered authenticated SQLi whose true impact the vendor score underrates, but whose tiny deployment base and lack of exploitation evidence make it low operational priority. Note the discrepancy explicitly: vendor rates only VC:L while the vulnerability class (SQLi via raw query) generally warrants higher confidentiality impact - verify data-exfiltration extent against the actual query context.

An authenticated low-privilege user of the project-management application navigates to the Timesheet Dashboard and submits a crafted value in the chart's filter parameter, which is concatenated into a whereRaw() SQL clause in ActivitiesReport.php. Using boolean or UNION-based techniques the attacker extracts arbitrary rows from the backend database (e.g., other users' credentials or timesheet data). A public exploit write-up is available on GitHub, lowering the skill barrier.