Executive brief
The Computer Laboratory System, a management platform for lab environments, contains a security flaw in its login process. An attacker can bypass the password requirement by entering a specially crafted command, gaining full administrative access to the system. This could lead to unauthorized access to lab records, system configuration changes, and complete control over the application.
Technical details
A SQL injection vulnerability exists in the login component of code-projects Computer Laboratory System 1.0 due to improper neutralization of special elements in the 'Password' input field (CWE-89). An unauthenticated remote attacker can exploit this by submitting a 'universal password' payload (e.g., ' OR 1=1 #) to bypass the authentication logic. Successful exploitation grants the attacker administrative privileges without a valid password. Testing with automated tools like sqlmap confirms that the password parameter is injectable and can be used to extract database information.
Affected products
- code-projects Computer Laboratory System 1.0
Timeline
- 2025-10-10: disclosed: Initial CVE publication
- 2025-10-15: advisory: CISA-ADP enrichment and CVSS scoring