Which versions of PHP are affected by CVE-2026-5198?

CVE-2026-5198 is a critical authentication bypass vulnerability in code-projects Student Membership System 1.0 that allows unauthenticated attackers to gain administrative access through SQL…

Is there a public PoC exploit available for CVE-2026-5198?

Yes, a public proof-of-concept exploit is available for CVE-2026-5198. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5198?

Within 24 hours: Identify all instances of code-projects Student Membership System 1.0 in your environment and isolate affected servers from untrusted networks; disable external admin login access if possible. Within 7 days: Implement WAF rules blocking SQL injection patterns targeting /admin/index.php, enforce strict input validation on username/password fields, and apply rate-limiting to authentication endpoints. Within 30 days: Migrate to an alternative system or contact vendor for patched version; conduct forensic review of admin access logs for unauthorized authentication attempts dating back 90 days.

PHP CVE-2026-5198

Q: What is the CVSS score of CVE-2026-5198?

CVE-2026-5198 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17399 MEDIUM

SQL Injection (CWE-89)

2026-03-31 VulDB

GHSA-x4c5-rphc-gh8c

PHP SQLi Student Membership System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 11:30 euvd

EUVD-2026-17399

Analysis Generated

Mar 31, 2026 - 11:30 vuln.today

CVE Published

Mar 31, 2026 - 11:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in code-projects Student Membership System 1.0 admin login allows unauthenticated remote attackers to bypass authentication and access sensitive data via crafted username/password parameters at /admin/index.php. Publicly available exploit code exists (VulDB 354296, GitHub POC), enabling trivial exploitation with no attack complexity. CVSS 7.3 reflects network-accessible attack with low confidentiality/integrity/availability impact. No vendor-released patch identified at time of analysis.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in the authentication mechanism of a PHP-based student membership management application. The /admin/index.php endpoint fails to properly sanitize or parameterize user input in the username and password fields before incorporating them into SQL queries. This allows attackers to inject malicious SQL syntax that alters query logic, typically enabling authentication bypass via tautology-based payloads (e.g., ' OR '1'='1) or UNION-based data extraction. The vulnerability exists in code-projects Student Membership System version 1.0, a seemingly unmaintained open-source project distributed via code-projects.org. The affected component is specifically the admin authentication handler, making this a critical entry point to administrative functionality.

RemediationAI

No vendor-released patch identified at time of analysis for code-projects Student Membership System 1.0. Immediate compensating controls include: remove internet accessibility to /admin/index.php via firewall rules or web application firewall (WAF) policies restricting admin panel access to trusted IP ranges only; implement web application firewall with SQL injection detection signatures to block malicious payloads; consider migrating to actively maintained student management software with security support. If continued use is required, apply input validation and parameterized SQL queries as code-level fixes-consult GitHub POC at https://github.com/maidangdang1/CVE/issues/4 to understand attack vectors for defensive coding. Long-term solution is software replacement given apparent abandonment of the code-projects repository. Monitor VulDB https://vuldb.com/vuln/354296 for any community patches or updates.