Feedback System CVE-2026-8098

Remote exploitation against default configurations of code-projects Feedback System 1.0 requires only that the /admin/checklogin.php endpoint be network-accessible - no authentication, user interaction, or non-default settings needed per CVSS vector AV:N/AC:L/PR:N/UI:N. The SQL injection occurs in the administrative login function itself, meaning the vulnerability exists before any authentication takes place. Exploitation is limited only by network reachability: instances behind IP restrictions, VPNs, or not exposed to internet are protected by network segmentation rather than application security. No specific PHP version, database backend (MySQL/MariaDB/PostgreSQL), or server configuration required - the vulnerable code logic triggers regardless of underlying stack. Deployment scenarios with administrative interfaces isolated on management VLANs or behind authentication proxies significantly reduce attack surface despite application-level vulnerability remaining unfixed.

Real-world risk is elevated due to convergence of multiple factors. CVSS 7.3 (High) with AV:N/AC:L/PR:N/UI:N indicates remote exploitation with no prerequisites - any internet-exposed instance is vulnerable. CVSS temporal metrics show E:P (Proof-of-concept exploit exists) and RL:X (no official fix information), confirming both exploit availability and absence of vendor remediation. The GitHub POC reference provides step-by-step exploitation instructions, making this accessible to low-skill attackers. Impact metrics (C:L/I:L/A:L) suggest partial confidentiality, integrity, and availability compromise - typical for authentication bypass leading to admin panel access. However, SQL injection frequently enables privilege escalation beyond CVSS-rated impact: attackers may extract entire databases, modify records, or use database features (xp_cmdshell, INTO OUTFILE) for server-level code execution. No CISA KEV listing suggests targeted rather than widespread mass exploitation, but small open-source projects often lack visibility into real-world attacks. Primary risk factors: public POC, authentication bypass target, likely abandoned project (code-projects.org hosts legacy PHP applications with irregular maintenance). CRITICAL GAP: No vendor advisory or patched version identified - remediation options limited to workarounds or application replacement.

Attacker identifies internet-exposed Feedback System 1.0 instance through Shodan/Censys search for characteristic HTTP headers or file paths. Navigates to /admin/checklogin.php and intercepts login POST request. Modifies email parameter to SQL injection payload such as ' OR '1'='1' -- to bypass authentication logic, gaining immediate administrative access. From compromised admin panel, attacker exports user feedback data containing PII, injects malicious JavaScript into feedback templates for stored XSS attacks against legitimate administrators, or leverages additional vulnerabilities to establish persistent backdoor.