EUVD-2026-54369
GHSA-92jx-33pg-rj87
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated login endpoint with no complexity; partial C/I/A impact consistent with limited SQL query manipulation per CVSS 4.0 signal.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
AnalysisAI
SQL injection in SourceCodester Photo Share Website 1.0 exposes the login endpoint /social/ajax.php?action=login to remote unauthenticated exploitation via the email parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector confirms zero-barrier access - no credentials, no complexity, no user interaction required against a default deployment. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the threshold for opportunistic attacks, though no active exploitation has been confirmed in CISA KEV.
Technical ContextAI
Photo Share Website 1.0 is a PHP-based open-source web application distributed by SourceCodester. The login handler at /social/ajax.php?action=login accepts a user-supplied email parameter that is incorporated into a SQL query without parameterization or sanitization, satisfying CWE-89 (Improper Neutralization of Special Elements used in SQL Command - SQL Injection). This is a textbook PHP string-concatenation SQL injection pattern, common in SourceCodester educational projects that use direct mysqli or similar calls without prepared statements. The CPE string cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:* uses a version wildcard, indicating all tracked versions are affected with no confirmed upper bound. The attack surface is the public-facing login form, requiring no session or account.
RemediationAI
No vendor-released patch has been identified at time of analysis. The definitive fix requires refactoring the login handler in /social/ajax.php to replace string-concatenated SQL with parameterized queries or prepared statements (e.g., PHP PDO or mysqli prepare()/bind_param()) - this eliminates the injection root cause. As an immediate compensating control, administrators should restrict access to the login endpoint at the web server or firewall layer if the application is not required to be publicly accessible; this eliminates remote exploitability but also blocks legitimate users. Deploying a WAF rule to detect and block common SQL injection patterns against the email parameter provides partial mitigation with lower availability impact, though WAF rules can be bypassed by determined attackers and may cause false positives on valid email inputs containing special characters. Rate-limiting requests to /social/ajax.php?action=login limits automated scanning efficiency but does not block the attack. Monitor https://vuldb.com/vuln/386713 and https://www.sourcecodester.com/ for any upstream patch release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today