Executive brief
A PHP-based task management application contains a SQL injection vulnerability in its login form that allows unauthenticated attackers to bypass authentication and extract sensitive data from the database. An attacker can submit a specially crafted email address to the login form to manipulate database queries and gain unauthorized access to user credentials, task data, and other sensitive information stored in the backend database.
Technical details
The vulnerability is a SQL injection flaw in the Operation::select_with_multiple_condition() function located in Classes/init.php. The POST parameter 'email' from the login form (index.php) is concatenated directly into a SQL WHERE clause without parameterization or input escaping: user_email = '".$email."'. This allows attackers to inject arbitrary SQL syntax. The vulnerability is unauthenticated and remotely exploitable via the public login endpoint, requiring no prior session or authorization. Attackers can execute blind SQL injection, error-based SQL injection, or time-based attacks to extract database contents, modify data, or bypass authentication. Remediation requires implementing prepared statements with parameter binding and strict input validation.
Affected products
- code-projects Task Management System 1.0
Timeline
- 2026-07-02: disclosed
- 2026-08-18: advisory: CVE-2026-75778 published
- 2026-08-18: other: Public exploit available