Executive brief
A security vulnerability exists in the PHPGurukul Daily Expense Tracking System, a web application used for managing personal finances. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive user information or the disruption of the service. This attack can be carried out remotely without requiring any user credentials or interaction.
Technical details
A SQL injection vulnerability exists in PHPGurukul Daily Expense Tracking System 1.1 within the '/register.php' component. The root cause is the failure to sanitize or validate the 'email' POST parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads (including boolean-based and time-based blind injection techniques) to manipulate database queries. Successful exploitation allows for unauthorized data retrieval, modification, or deletion. A public exploit (PoC) has been released, and the vulnerability can be exploited using automated tools like sqlmap.
Affected products
- PHPGurukul Daily Expense Tracking System 1.1
Timeline
- 2026-04-05: disclosed: Vulnerability details and PoC shared on GitHub by researcher f1rstb100d.
- 2026-04-13: advisory: CVE-2026-6193 published.