EUVD-2026-54912
GHSA-6h24-vmwh-x75r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Pre-auth network SQLi on login form yields full DB read (C:H) and write (I:H); availability impact is limited to data manipulation, not service disruption.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
AnalysisAI
SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.
Technical ContextAI
The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected component is a PHP login handler at /admin/AdminLogin.php within a web application built on the code-projects Task Management System platform, identified by CPE cpe:2.3:a:code-projects:task_management_system:*:*:*:*:*:*:*:*. The wildcard version in the CPE string suggests the flaw is not version-pinned and may affect all releases. The root cause is direct interpolation of user-supplied HTTP POST parameters (email, password) into SQL query strings without parameterization or escaping, a classic pattern in PHP applications that do not use prepared statements. Because the injection point is the authentication form itself, exploitation is pre-authentication and requires no prior foothold.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis; patch availability is unconfirmed from the provided references. The primary fix is to rewrite the SQL query logic in /admin/AdminLogin.php to use prepared statements with parameterized queries (PDO or MySQLi with bind_param), eliminating direct interpolation of the email and password inputs. Until a patch is available, restrict network access to the /admin/ directory to trusted IP ranges via web server configuration (e.g., Apache Allow/Deny directives or nginx geo-blocking), which removes remote exposure at the cost of limiting legitimate remote admin access. Deploying a web application firewall (WAF) rule targeting common SQL injection patterns on the login endpoint provides defense-in-depth but should not be treated as a primary control, as WAF bypass techniques are well-documented. The GitHub POC is available at https://github.com/littleRain1355/PHPissue/issues/2 and the VulDB entry at https://vuldb.com/vuln/387179 for further reference.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today