Which versions of PHP are affected by CVE-2026-6490?

QueryMine SMS contains an unauthenticated SQL injection vulnerability in the administrative course deletion function that allows attackers to read, modify, or delete database records without…

Is there a public PoC exploit available for CVE-2026-6490?

Yes, a public proof-of-concept exploit is available for CVE-2026-6490. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6490?

Within 24 hours: Identify all QueryMine SMS instances in production and development environments; isolate or restrict network access to the admin interface (specifically /admin/deletecourse.php) using firewall rules or WAF policies. Within 7 days: Implement network segmentation to limit admin interface exposure; enable SQL query logging and review for suspicious activity in the past 30 days; document all instances and their data sensitivity. Within 30 days: Evaluate migration to alternative SMS platform or fork/patch QueryMine SMS if internal capability exists; conduct forensic database audit for unauthorized modifications; implement input validation and parameterized query enforcement if continuing use.

PHP CVE-2026-6490

Q: What is the CVSS score of CVE-2026-6490?

CVE-2026-6490 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23427 MEDIUM

SQL Injection (CWE-89)

2026-04-17 VulDB

GHSA-w25c-m5vq-j5mh

PHP SQLi Sms Querymine

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 17, 2026 - 14:22 NVD

HIGH MEDIUM

CVSS changed

Apr 17, 2026 - 14:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 17, 2026 - 13:57 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 13:45 euvd

EUVD-2026-23427

Analysis Generated

Apr 17, 2026 - 13:45 vuln.today

CVE Published

Apr 17, 2026 - 13:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file admin/deletecourse.php of the component GET Request Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in QueryMine SMS admin/deletecourse.php allows remote unauthenticated attackers to read, modify, or delete database records via the ID parameter in GET requests. Affects all versions up to commit 7ab5a9ea196209611134525ffc18de25c57d9593. Public exploit code exists (GitHub POC available). EPSS data not available. Not listed in CISA KEV. Vendor non-responsive to disclosure. CVSS 7.3 with network attack vector and no authentication required indicates moderate-high severity, but real-world risk depends on deployment exposure of admin interface.

Technical ContextAI

QueryMine SMS is a PHP-based school management system. The vulnerability exists in admin/deletecourse.php, which handles course deletion operations through GET request parameters. The ID parameter lacks proper input validation and parameterized query usage, allowing SQL injection (CWE-89). Attackers can inject malicious SQL commands through the ID parameter to manipulate backend database queries. The affected component is the GET Request Parameter Handler, suggesting direct concatenation of user input into SQL statements rather than using prepared statements or ORM query builders. The product uses a rolling release model without semantic versioning, making version tracking dependent on Git commit hashes (affected through commit 7ab5a9ea19).

RemediationAI

No vendor-released patch identified at time of analysis despite early disclosure - vendor non-responsive per VulDB report. Immediate compensating controls: (1) Restrict network access to admin/deletecourse.php and all admin/* paths to trusted internal IP ranges only via web server configuration (Apache mod_authz_host or nginx allow/deny directives) - eliminates remote attack vector but breaks legitimate remote admin access. (2) Deploy web application firewall with SQL injection signatures to filter malicious ID parameter values - may cause false positives on legitimate numeric IDs containing SQL-like patterns. (3) Implement application-layer authentication verification before admin/deletecourse.php execution if not already enforced - requires code modification. (4) For self-hosted deployments, apply input validation patch manually: replace direct ID parameter usage with parameterized queries using PDO prepared statements or mysqli_prepare in admin/deletecourse.php - requires PHP development expertise and ongoing maintenance for rolling release updates. (5) Consider migrating to actively maintained alternative school management systems with responsive security practices. Monitor GitHub repository (https://github.com/duckpigdog/CVE/blob/main/QueryMine_sms%20PHP%20Project%20Deployment%20Document%20(Windows%20Local)-1.md) for community patches. VulDB CTI reference: https://vuldb.com/vuln/358034/cti.