Executive brief
Twitter-Clone, a PHP-based social media application, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted web requests, an attacker can steal sensitive information such as user passwords, account details, and database credentials. This could lead to full account takeovers and the exposure of private user data.
Technical details
A SQL injection vulnerability exists in Twitter-Clone version 1.0 due to improper neutralization of special elements in the 'userid' and 'username' parameters within follow.php and index.php. The application uses mysqli_query to execute statements where user-supplied input is concatenated directly into the SQL string without sanitization. An unauthenticated remote attacker can exploit this using union-based or time-based blind SQL injection techniques. Successful exploitation allows for the extraction of sensitive data from the database, including user credentials and system information. While the vulnerability was identified in 2018, it was formally assigned a CVE in 2026; no official patch is currently documented in the advisory.
Affected products
- Fyffe (PHP-Twitter-Clone) Twitter-Clone 1.0
Timeline
- 2018-08-21: disclosed: Original exploit published on Exploit-DB
- 2026-05-25: advisory: CVE published and NVD entry created