EUVD-2026-25865Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed ProjeQtor login page
-
DeliveryCraft SQL payload in username field
-
ExploitSubmit to authentication endpoint
-
ExecutionInjected SQL executes in database
-
PersistCreate admin account or dump data
-
ImpactEscalate to OS commands if DB privileged
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability of the ProjeQtor authentication/login endpoint and a version in the 7.0-12.4.3 range; no authentication, credentials, or user interaction are needed (PR:N/UI:N/AT:N), so it works against default configurations. The username/login field at the login endpoint is the injectable parameter. The primary limiting factor is scope of impact: privilege-escalation to operating-system command execution is conditional on the backing database account holding elevated permissions (e.g., FILE/OS-exec rights) - where the DB user is restricted, impact is bounded to data read/write and account creation within the database. The other real-world limiter is exposure: the instance must be network-accessible to the attacker. |
| Impact | Signals are mostly aligned toward high severity but with one notable tension. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA all High, score 9.3) indicates trivial remote, unauthenticated, no-interaction exploitation with total impact, and SSVC reinforces this: exploitation=poc, automatable=yes, technical impact=total. Public exploit code is confirmed available. The contrasting signal is EPSS at just 0.09% (26th percentile), which is low; this reflects that the product is niche rather than that the bug is hard - automatable pre-auth SQLi with PoCs is genuinely dangerous wherever ProjeQtor is exposed. It is NOT in CISA KEV, so there is no confirmed active exploitation. Net: a real, high-priority issue for any organization running an internet-facing ProjeQtor instance, but the low overall internet footprint tempers mass-exploitation likelihood, suggesting opportunistic/targeted rather than worm-scale risk. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed ProjeQtor login page and submits a crafted username value containing SQL syntax to the authentication endpoint, requiring no credentials or user interaction. Using the public PoC (e.g., github.com/0xBlackash/CVE-2026-41462), they inject SQL to dump user/password tables or insert a new administrator account, and if the database user is over-privileged they pivot to executing operating-system commands on the database host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
SQL injection in ProjeQtor's login endpoint lets unauthenticated remote attackers inject arbitrary SQL through the username field, because the login variable is concatenated directly into a query without parameterization. Affecting versions 7.0 through 12.4.3, it can be leveraged to create privileged accounts, exfiltrate database contents, and - where the DB account has elevated OS privileges - achieve operating-system command execution. Publicly available exploit code exists (VulnCheck advisory and multiple PoCs), though EPSS remains low at 0.09% and it is not listed in CISA KEV.
RemediationAI
Upgrade ProjeQtor to a release later than 12.4.3 that contains the login-parameterization fix; the input does not specify an exact fixed version, so treat this as Patch available per vendor advisory and confirm the fixed build directly with ProjeQtor (https://www.projeqtor.com) and the VulnCheck advisory (https://www.vulncheck.com/advisories/projeqtor-unauthenticated-sql-injection-via-login) before deploying. Until patched, restrict network reachability of the login/authentication endpoint by placing the application behind a VPN or IP allowlist, and deploy a WAF rule to block SQL metacharacters and injection patterns in the username field (trade-off: WAF signatures can be bypassed and may cause false positives on legitimate logins). Additionally, enforce least privilege on the ProjeQtor database account - remove FILE, SUPER, and OS-command-capable privileges so a successful injection cannot escalate to operating-system command execution (trade-off: none significant, but requires validating the app still functions with reduced grants). Do not rely on these controls as a permanent substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ProjeQtor is a PHP-based open-source project management / QMS web application backed by a relational database (typically MySQL/MariaDB). The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue: the authentication handler builds its lookup query by string-concatenating the attacker-supplied login/username value rather than using prepared statements or bound parameters. Because this occurs at the pre-authentication login endpoint, the injected SQL executes with whatever rights the application's database user holds. The single CPE cpe:2.3:a:projeqtor:projeqtor:*:*:*:*:*:*:*:* confirms the affected component is the ProjeQtor application itself across the vulnerable version band, not a bundled third-party library.
Know when Projeqtor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Pre-auth, remote, no-interaction SQL injection with low complexity gives AV:N/AC:L/PR:N/UI:N; full database confidentiality, integrity, and availability impact yields C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.
Articles & Coverage 1
Executive ViewAI
ProjeQtor versions 7.0-12.4.3 contain a critical SQL injection vulnerability in the login page that allows unauthenticated attackers to compromise your project management system and underlying databases. Any organization running these versions risks unauthorized access to project data, internal communications, team credentials, and potentially other connected systems, with no vendor patch currently available to address the threat.
Implement Web Application Firewall (WAF) rules to block SQL injection payloads in login requests; restrict database user privileges and disable unnecessary OS-level database access; enable comprehensive database query logging and audit trails; segment ProjeQtor systems from production networks using network firewalls; rotate all database and system credentials; implement database connection limits and rate limiting; monitor authentication logs for unusual patterns; consider restricting login page access to specific IP ranges if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/pri
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file
Remote code execution in ProjeQtor 7.0 through 12.4.3 arises from a ZipSlip flaw in the plugin upload feature, where aut
SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrar
Arbitrary file disclosure in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to read .log files anywhere on
Sensitive data disclosure in ProjeQtor 7.0 through 12.4.3 lets an authenticated guest-level user retrieve other users' r
projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceE
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to upload HTML or HTM files v
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 enables authenticated users to inject persistent malicious H
uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a
Multiple cross-site scripting (XSS) vulnerabilities in ProjeQtOr (formerly Project'Or RIA) before 4.0.0 allow remote att
Exploit-DB