What is the CVSS score of CVE-2026-30520?

CVE-2026-30520 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-30520?

Yes, a public proof-of-concept exploit is available for CVE-2026-30520. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-30520

EUVD-2026-17581 MEDIUM

SQL Injection (CWE-89)

2026-03-31 mitre

GHSA-v3wc-4m78-26x4

PHP SQLi N A

5.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 06, 2026 - 14:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17581

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 00:00 nvd

MEDIUM 5.4

DescriptionCVE.org

A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save_loan action). The application fails to properly sanitize user input supplied to the "borrower_id" parameter in a POST request, allowing an authenticated attacker to inject malicious SQL commands.

AnalysisAI

Blind SQL injection in SourceCodester Loan Management System v1.0 allows authenticated attackers to inject malicious SQL commands via the borrower_id parameter in the ajax.php save_loan action. The vulnerability requires valid authentication to exploit and publicly available proof-of-concept code exists, making this a moderate-risk issue for organizations using this open-source application despite the lack of CVSS scoring.

Technical ContextAI

The vulnerability is a SQL injection flaw (CWE class) in a PHP-based loan management application. The ajax.php file processes POST requests with a save_loan action that accepts a borrower_id parameter without proper input sanitization or parameterized query protection. SourceCodester Loan Management System is a lightweight PHP application commonly used by small financial institutions and development environments for loan tracking. The blind SQL injection variant means the attacker cannot directly observe query results but can use time-based or boolean-based inference techniques to extract data through conditional logic in crafted SQL payloads.

RemediationAI

No vendor-released patched version is confirmed at time of analysis. Immediate remediation requires applying input validation and parameterized queries: (1) Replace all string concatenation in SQL queries affecting borrower_id with prepared statements using parameterized placeholders (mysqli_prepare or PDO prepared statements in PHP); (2) Implement strict input whitelisting to validate borrower_id as a positive integer before any database interaction; (3) Apply Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST parameters. If patching the application code is not feasible, isolate affected instances to administrative networks only and enforce multi-factor authentication on all accounts accessing the system. Review the publicly available POC at https://github.com/meifukun/Web-Security-PoCs/blob/main/Loan-Management-System/SQLi-SaveLoan-borrowerId.md to understand the attack vector and validate remediation effectiveness.