File Management System CVE-2026-114255

Exploitation requires sending a request to the User Account Management function (save_user in admin_class.php) with a malicious value in the name, username, password, type, or id argument, which is passed unsanitized into a SQL query. The input CVSS vector marks this as remotely reachable without authentication (PR:N) or user interaction, meaning default deployments may be exploitable by any remote attacker who can reach the admin_class.php endpoint; however, because this function lives in the application's admin/user-management area, the practical limiting factor is whether the installation enforces authentication or access control on that endpoint - if it does, an attacker needs valid (likely admin-level) credentials or an auth-bypass to reach it. No fixed version exists to migrate to due to the rolling-release model.

This is a SQL injection (CWE-89) in the save_user function of oretnom23's file-management-system-php, a small open-source/hobby PHP application. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores only 6.9 (Medium) because the impact metrics are all Low (VC:L/VI:L/VA:L) rather than High, which is unusually conservative for a SQLi that typically allows full read/write of the backing database. The E:P (Proof-of-Concept) modifier and the 'POC publicly available' signal confirm publicly available exploit code exists, but this is NOT CISA KEV-listed and no EPSS score was provided, so there is no evidence of active, widespread exploitation - exploit availability and active exploitation are distinct signals. Net: real risk is driven more by the triviality of SQLi (AC:L, no user interaction) and public exploit code than by raw CVSS. A key conflict to verify: the vector asserts PR:N (unauthenticated), yet save_user resides in admin_class.php under 'User Account Management,' which normally implies an authenticated admin context - if access control is in fact enforced, the real-world privilege requirement is higher than the vector claims. Rolling-release versioning means there is no fixed version to anchor remediation, and the vendor has not responded to the issue report.

A remote attacker reaches the user-account management endpoint handled by save_user in admin_class.php and submits a crafted value in one of the name, username, password, type, or id parameters. Because input is concatenated into a SQL statement, the attacker injects SQL to read or manipulate the database (e.g., dumping credentials or forging an admin account). Public exploit code is available (referenced via the GitHub issue), lowering the skill needed to weaponize this.