Task Management System EUVD-2026-60732

The /index.php login form must be network-accessible to the attacker - no authentication is required before the vulnerable code path executes, as the injection point is the pre-authentication login handler itself. The target server must be running code-projects Task Management System in PHP, with the Operation::select_with_multiple_condition function serving as the login query handler. No special configuration, non-default feature flag, or privileged deployment mode is required; the default installed state is sufficient for exploitation. Exploitation is limited by the niche deployment footprint of this specific product - organizations not running code-projects Task Management System are entirely unaffected. The CVSS 4.0 vector confirms no attack-complexity requirement (AC:L, AT:N) and no user interaction (UI:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) represents the most exploitable combination of base metrics: network-reachable, no complexity, no privileges, no user interaction. The E:P exploit modifier confirms a working proof of concept is publicly available. Impact metrics (VC:L/VI:L/VA:L with no downstream scope change) suggest partial compromise of confidentiality, integrity, and availability within the vulnerable system only - not full database takeover confirmed from available data. No EPSS score was provided in the intelligence, so exploitation probability cannot be quantified numerically; however, the combination of unauthenticated login-form attack surface and public PoC means even a mid-sized municipal IT team in boleslawiec should treat this as urgent if they have deployed this application externally. The moderate base score of 6.9 somewhat undersells practical risk given the zero-authentication requirement and PoC availability; conversely, the niche and low-prevalence footprint of this product limits aggregate impact across the broader threat landscape. KEV status is not confirmed, suggesting exploitation has not yet been documented at scale.

An unauthenticated attacker identifies a publicly accessible instance of code-projects Task Management System and submits a crafted payload such as ' OR '1'='1'-- in the email field of the login form at /index.php, causing the SQL query in Operation::select_with_multiple_condition to return all user rows and bypass authentication. With login-form access bypassed, the attacker gains access to the application's privileged functions or proceeds to enumerate the underlying database via further injection payloads. A working proof-of-concept is publicly documented at https://github.com/niaoniaollll/cve/issues/5, making this reproducible by low-skill attackers.