CVE-2026-114255: oretnom23 file-management-system-php SQL injection in user account management

CVE-2026-114255 · Severity: high · CVSS 7.3 · Published 2026-10-21

A file management and document-sharing application built in PHP contains an unauthenticated SQL injection vulnerability in its user account management function. An attacker can remotely exploit this flaw without logging in to create administrator accounts, reset existing passwords, or gain complete control of the application and all stored files.

Technologies: Oretnom23 File-Management-System-Php. Vendors: Oretnom23.

Quick answers

Is CVE-2026-114255 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114255 being exploited in the wild.
How severe is CVE-2026-114255?
High severity, with a CVSS score of 7.3, published 21 October 2026.
Which products and versions are affected?
Oretnom23 File-Management-System-Php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4.
Is there a fix for CVE-2026-114255?
No fixed version is recorded yet. Use prepared statements or parameterized queries instead of string concatenation for all database operations. Implement mandatory authentication and session validation on the ajax.php endpoint before allowing any user management actions. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-114255 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-114255?
Check whether you run Oretnom23 File-Management-System-Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements or parameterized queries instead of string concatenation for all database operations. Implement mandatory authentication and session validation on the ajax.php endpoint before allowing any user management actions.

Technical details

The save_user() function in admin_class.php builds SQL INSERT/UPDATE statements by direct string concatenation of unsanitized POST parameters (name, username, password, type, id) without prepared statements or parameterized queries. The ajax.php endpoint that invokes this function lacks any authentication or session validation, allowing unauthenticated remote attackers to inject SQL. An attacker can create a new administrator account or modify existing user records to gain full application privileges.

Affected products

  • oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4

Timeline

  • 2026-10-21: disclosed: Published to NVD
  • 2026-10-07: other: Issue reported to project on GitHub; no response received

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.