Executive brief
Easy Blog Site is a PHP-based web application used for managing and publishing blog content. A security vulnerability in the application allows remote attackers to manipulate database queries. This could lead to unauthorized access to sensitive information, data tampering, or full control over the website's database.
Technical details
A SQL injection vulnerability exists in code-projects Easy Blog Site 1.0 within the 'post.php' component. The root cause is the improper sanitization of the 'tags' GET parameter before it is used in a SQL query. An attacker can exploit this by sending specially crafted HTTP requests containing SQL commands (supporting boolean-based blind, error-based, time-based blind, and UNION query techniques). Successful exploitation allows for unauthorized database access, data exfiltration, and potential administrative bypass. While some metrics suggest low privileges (PR:L) are required, the researcher's report indicates no login or authorization is necessary for exploitation. No official patch is currently available; users are advised to implement prepared statements and parameter binding.
Affected products
- code-projects Easy Blog Site 1.0
Timeline
- 2026-04-06: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-04-13: advisory: CVE published and VulDB entry created