Executive brief
SourceCodester Engineers Online Portal v1.0 contains a critical security flaw in its password update functionality. An attacker can use this flaw to send malicious commands to the application's database without needing a username or password. This could allow an unauthorized person to view sensitive user data, modify information, or gain full control over the portal's database.
Technical details
A SQL injection vulnerability exists in SourceCodester Engineers Online Portal v1.0 within the 'update_password.php' component. The application fails to properly sanitize the 'new_password' parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests to execute arbitrary SQL commands. This can lead to unauthorized data retrieval, modification of database records, or complete compromise of the underlying database server. The vulnerability is reachable over the network without user interaction.
Affected products
- SourceCodester Engineers Online Portal 1.0
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory: NVD publication date
- 2026-04-14: other: NIST/CISA analysis completed