Daily Expense Tracking System
Monthly
SQL injection in PHPGurukul Daily Expense Tracking System 1.1 exposes the unauthenticated `/register.php` registration endpoint to remote database manipulation via a crafted `email` parameter. A proof-of-concept exploit has been publicly released on GitHub, and SSVC assessment confirms the attack is automatable with no prerequisites beyond network access to the application. No public exploitation at scale has been confirmed (not in CISA KEV) and EPSS remains at 0.03%, though the unauthenticated attack surface combined with available exploit code represents a concrete risk for any internet-facing deployment.
SQL injection in PHPGurukul Daily Expense Tracking System 1.1 exposes the unauthenticated `/register.php` registration endpoint to remote database manipulation via a crafted `email` parameter. A proof-of-concept exploit has been publicly released on GitHub, and SSVC assessment confirms the attack is automatable with no prerequisites beyond network access to the application. No public exploitation at scale has been confirmed (not in CISA KEV) and EPSS remains at 0.03%, though the unauthenticated attack surface combined with available exploit code represents a concrete risk for any internet-facing deployment.