Executive brief
PHPGurukul News Portal Project, a web application used for managing online news content, contains a security vulnerability in its comment submission feature. An attacker can exploit this to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the disruption of the news site. This attack can be performed remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in PHPGurukul News Portal Project 4.1 within the '/news-details.php' file. The root cause is the failure to sanitize or validate the 'comment' POST parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request containing SQL payloads (such as time-based blind injection). Successful exploitation allows for unauthorized database access, data exfiltration, and potential full system compromise. A public exploit (PoC) using sqlmap has been disclosed. No official patch is currently documented, but remediation should involve implementing prepared statements and parameterized queries.
Affected products
- PHPGurukul News Portal Project 4.1
Timeline
- 2026-03-26: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-04-09: advisory: CVE-2026-5837 published