Executive brief
Assessment Management is a PHP-based educational project management application. A SQL injection vulnerability in the login page allows unauthenticated attackers to bypass authentication, extract sensitive data from the database, or modify records by injecting malicious SQL through the userid parameter.
Technical details
A blind SQL injection vulnerability exists in the welcome.php file of Assessment Management 1.0, where the 'userid' parameter is directly concatenated into SQL SELECT queries without sanitization, escaping, or parameterized statements. The vulnerability is unauthenticated and remotely exploitable via POST requests. An attacker can inject SQL commands through the userid field to extract database contents (including usernames, passwords, and other sensitive data), modify or delete records, or potentially execute operating system commands depending on database permissions. The fix requires implementing prepared statements with parameter binding, strict input validation, and database permission restrictions.
Affected products
- code-projects Assessment Management 1.0
Timeline
- 2026-07-03: disclosed: Vulnerability reported on GitHub
- 2026-08-20: advisory: CVE-2026-76762 published