Core Php Admin Panel
Monthly
SQL injection in chetans9's core-php-admin-panel exposes the customers.php endpoint to remote authenticated attackers who can manipulate the filter_col argument to execute arbitrary SQL against the backend database. All code up to commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f on the rolling-release branch is affected, with no vendor patch issued as the maintainer did not respond to disclosure. A public proof-of-concept exploit is available via GitHub, though no confirmed active exploitation has been recorded by CISA KEV; CVSS 4.0 scores the overall risk at 2.1, reflecting limited but real partial data exposure and database manipulation potential.
SQL injection in chetans9's core-php-admin-panel exposes the customers.php endpoint to remote authenticated attackers who can manipulate the filter_col argument to execute arbitrary SQL against the backend database. All code up to commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f on the rolling-release branch is affected, with no vendor patch issued as the maintainer did not respond to disclosure. A public proof-of-concept exploit is available via GitHub, though no confirmed active exploitation has been recorded by CISA KEV; CVSS 4.0 scores the overall risk at 2.1, reflecting limited but real partial data exposure and database manipulation potential.