SourceCodester Simple CRUD EUVD-2026-119816

The concrete prerequisite is reaching the registration endpoint app/register.php and supplying a malicious value in the firstname form field, which is injected into a SQL query. The attack is remote over the network (AV:N) with low complexity and no user interaction. Limiting factors: impact is only partial (VC:L/VI:L/VA:L - no full database compromise is claimed); the input vector marks PR:L, implying some account/privilege may be needed, though a public registration page is typically reachable pre-authentication; and the affected product is a niche SourceCodester demo application with minimal real deployment. No non-default configuration is described as required.

This is a moderate-severity SQL injection (CWE-89) in SourceCodester 'Simple CRUD using PHP and FPDF' 1.0, a small demo/tutorial PHP application. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 5.3 with partial impact across all three dimensions (VC:L/VI:L/VA:L), and the exploit maturity is E:P (proof-of-concept), not active exploitation. No EPSS score and no CISA KEV entry were provided, and the vuln.today decision label is 'this_month' rather than act_now or emergency - all signals point to a real but non-urgent, low-footprint issue rather than a top-priority emergency. The dominant risk-reducing factor is prevalence: this is obscure hobby/tutorial software with essentially no enterprise deployment, so even a clean SQLi has limited real-world blast radius. One signal conflicts and should be verified: the input assigns PR:L (authenticated), yet the affected endpoint is a public registration page (app/register.php, parameter firstname), which is normally reachable without authentication - if that is the case, real-world exploitability is higher than PR:L implies. Overall this is a low-to-moderate priority: a confirmed-class flaw in a rarely-deployed product with only a PoC-maturity, unverified exploit reference.

A remote attacker submits the registration form (or crafts an equivalent HTTP request) to app/register.php and injects SQL metacharacters into the firstname parameter, which is concatenated into a backend query. Because attack complexity is low (AC:L) and no user interaction is required (UI:N), this can be automated to read or tamper with database contents. A public PoC reference exists on GitHub but is not verified as working exploit code.