DevaslanPHP Project Management EUVD-2026-88066

Requires an authenticated session on the DevaslanPHP project-management application (CVSS PR:L - a valid low-privileged account) with access to the Timesheet Dashboard feature; the attacker manipulates the 'filter' argument consumed by whereRaw() in the MonthlyReport widget. No user interaction is required (UI:N) and the attack is remote over the network (AV:N). Limiting factors: exploitation is gated by having valid credentials, the product is a niche self-hosted application with tiny deployment, and no patch exists so only currently-deployed instances are at risk.

This is a high-CVSS-in-my-assessment but low-real-world-priority issue. It is a genuine SQL injection (CWE-89) reachable remotely, but multiple signals temper the risk. The vendor-provided CVSS 4.0 vector (5.3, PR:L, VC/VI/VA:L, E:P) understates the technical impact of a whereRaw SQL injection, which typically permits full database read (C:H) rather than the limited VC:L the vendor assigned; my independent CVSS 3.1 assessment is closer to 8.2. Countering that, the exploit maturity is only Proof-of-Concept (E:P) - a POC exists on GitHub (dddwmr) but there is NO CISA KEV listing and NO EPSS score available, so there is no evidence of widespread or automated exploitation. The single most important limiter is that the affected product, DevaslanPHP project-management, is an obscure self-hosted GitHub project with negligible deployment footprint. The vendor was contacted and did not respond, and no patched version is available, which means exposed instances stay vulnerable - but the population of exposed instances is tiny. Net: real but narrow, targeted-at-best risk, not a fleet-wide emergency.

An attacker with a low-privileged authenticated account (PR:L) on a DevaslanPHP project-management instance navigates to the Timesheet Dashboard and supplies a crafted value in the 'filter' parameter, which is interpolated into a whereRaw() clause without sanitization. Because a public proof-of-concept exists (GitHub, dddwmr), the attacker can adapt it directly to extract database contents such as user credentials or project data via UNION/boolean-based injection. No user interaction or elevated privileges are needed beyond a normal login.