EUVD-2026-88066
GHSA-8gh5-g75w-3wfh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryOpen Timesheet Dashboard MonthlyReport widget
-
ExploitInject SQL via 'filter' argument into whereRaw
-
ExecutionDatabase interprets malicious query
-
ImpactExfiltrate credentials and project data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session on the DevaslanPHP project-management application (CVSS PR:L - a valid low-privileged account) with access to the Timesheet Dashboard feature; the attacker manipulates the 'filter' argument consumed by whereRaw() in the MonthlyReport widget. No user interaction is required (UI:N) and the attack is remote over the network (AV:N). Limiting factors: exploitation is gated by having valid credentials, the product is a niche self-hosted application with tiny deployment, and no patch exists so only currently-deployed instances are at risk. |
| Impact | This is a high-CVSS-in-my-assessment but low-real-world-priority issue. It is a genuine SQL injection (CWE-89) reachable remotely, but multiple signals temper the risk. The vendor-provided CVSS 4.0 vector (5.3, PR:L, VC/VI/VA:L, E:P) understates the technical impact of a whereRaw SQL injection, which typically permits full database read (C:H) rather than the limited VC:L the vendor assigned; my independent CVSS 3.1 assessment is closer to 8.2. Countering that, the exploit maturity is only Proof-of-Concept (E:P) - a POC exists on GitHub (dddwmr) but there is NO CISA KEV listing and NO EPSS score available, so there is no evidence of widespread or automated exploitation. The single most important limiter is that the affected product, DevaslanPHP project-management, is an obscure self-hosted GitHub project with negligible deployment footprint. The vendor was contacted and did not respond, and no patched version is available, which means exposed instances stay vulnerable - but the population of exposed instances is tiny. Net: real but narrow, targeted-at-best risk, not a fleet-wide emergency. |
| Exploit ScenarioDerived | An attacker with a low-privileged authenticated account (PR:L) on a DevaslanPHP project-management instance navigates to the Timesheet Dashboard and supplies a crafted value in the 'filter' parameter, which is interpolated into a whereRaw() clause without sanitization. Because a public proof-of-concept exists (GitHub, dddwmr), the attacker can adapt it directly to extract database contents such as user credentials or project data via UNION/boolean-based injection. No user interaction or elevated privileges are needed beyond a normal login. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
SQL injection in the Timesheet Dashboard of DevaslanPHP project-management (versions 1.2.1, 1.2.2, 1.2.3, 1.2.4 and v2.0.0-beta1) lets an authenticated remote attacker with a valid low-privileged account manipulate the 'filter' argument consumed by whereRaw() in app/Filament/Widgets/Timesheet/MonthlyReport.php and inject SQL against the application's backend database. Publicly available exploit code exists (a proof-of-concept write-up is published on GitHub), so the technique is within reach of moderately skilled attackers, although exploitation still requires a working session on the instance. The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis; the vendor-assigned CVSS 4.0 base score is 5.3 (Medium), while our independent assessment rates the confidentiality impact High with only limited integrity impact.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainer was contacted about the disclosure but did not respond, and no fixed version appears in the CPE data, so 1.2.1 through 1.2.4 and v2.0.0-beta1 should be treated as unfixed. Until an upstream fix ships, the most effective compensating control is to stop the tainted value from reaching whereRaw() - patch the MonthlyReport widget locally to bind the 'filter' parameter or whitelist only the expected column/direction tokens, and test the dashboard for regressions before deploying; alternatively remove or disable the Timesheet Dashboard / MonthlyReport widget entirely, which eliminates the attack surface at the cost of the monthly reporting feature. Restrict access to the Timesheet Dashboard to the smallest set of trusted, fully verified accounts (the flaw requires an authenticated session, so account hygiene and removal of stale or shared logins materially reduces exposure), and deploy a WAF or reverse-proxy rule that blocks SQL metacharacter patterns in dashboard chart-filter requests, accepting the usual risk of false positives on legitimate filters. Run the application's database user with least privilege (no DDL, no access to unrelated schemas) so that successful injection yields less data and no schema modification. Track the VulDB entries at https://vuldb.com/vuln/410849 and https://vuldb.com/cve/CVE-2026-100899 and the PoC at https://github.com/dddwmr/CVE/blob/main/Timesheet%20Dashboard%20Chart%20Filter%20SQL%20Injection%20(MonthlyReport).md for a future vendor fix, and consider applying the same parameterization fix to any other whereRaw() usage in the codebase.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a self-hosted PHP/Laravel project-management application that uses the Filament admin framework to render its Timesheet Dashboard widgets. The vulnerable component, app/Filament/Widgets/Timesheet/MonthlyReport.php, builds a monthly report query using Laravel's whereRaw() helper, which accepts a raw SQL fragment rather than a parameterized binding. Because a user-controlled 'filter' value reaches that raw fragment without effective sanitization or binding, an attacker can append SQL syntax and alter the semantics of the generated statement. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw: the root cause is the use of unparameterized raw SQL in an ORM context where safe bindings or identifier whitelisting should have been used. A CPE of cpe:2.3:a:devaslanphp:project-management:*:*:*:*:*:*:*:* is attached, indicating the vulnerability is tracked against the project-management product as a whole rather than a single tagged release, consistent with the affected range 1.2.1 through 1.2.4 plus the v2.0.0-beta1 prerelease.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable whereRaw SQL injection needing only a low-privileged account (PR:L, AC:L); grants full DB read (C:H) with limited write/integrity impact (I:L) and no availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the component Timesheet Dashboard. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in DevaslanPHP project-management SQLi and SSRF
View all 3In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB