# CVE-2026-78143: code-projects Barangay Resident Profiling Management System SQL injection in resident search

Source: https://junglewise.ai/threats/cve-2026-78143-code-projects-barangay-resident-profiling-management-system-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78143 · Severity: high · CVSS 7.3 · Published 2026-08-23

The Barangay Resident Profiling Management System is a web application used to manage and search resident records. A SQL injection vulnerability in the resident search functionality allows remote attackers to manipulate search queries and potentially access, modify, or delete sensitive resident data without proper authorization. The system relies on weak SQL escaping instead of parameterized queries, making it susceptible to bypass techniques.

Technologies: [Code-Projects Barangay Resident Profiling Management System](https://junglewise.ai/threats/technologies/barangay-resident-profiling-management-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-78143 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78143 being exploited in the wild.

**How severe is CVE-2026-78143?** High severity, with a CVSS score of 7.3, published 23 August 2026.

**Which products and versions are affected?** Code-Projects Barangay Resident Profiling Management System 1.0.

**Is there a fix for CVE-2026-78143?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78143 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78143?** Check whether you run Code-Projects Barangay Resident Profiling Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in residents.php due to unsafe SQL query construction. The search parameter from the GET request is escaped using real_escape_string() but then directly concatenated into a SQL fragment, rather than using prepared statements with parameter binding. The vulnerable code concatenates user input into LIKE clauses without proper parameterization. The attack is network-accessible and requires a valid session cookie, but no other authentication bypass is needed to exploit the search functionality. An attacker can inject SQL logic to bypass search restrictions and retrieve unintended resident records. The vulnerability is unpatched; the fix requires using prepared statements with bound parameters instead of string concatenation.

## Affected products

- code-projects Barangay Resident Profiling Management System 1.0

## Timeline

- 2026-07-07: disclosed: Vulnerability disclosed on GitHub Gist
- 2026-08-23: advisory: CVE-2026-78143 published on NVD

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://gist.github.com/c4ttr4ck/504e89cacf12c7d6a87490f3859dfded](https://gist.github.com/c4ttr4ck/504e89cacf12c7d6a87490f3859dfded)

## Related threats

- [code-projects Barangay Resident Profiling Management System authorization bypass in boarder management](https://junglewise.ai/threats/cve-2026-78144-code-projects-barangay-resident-profiling-management-system)
- [Barangay Resident Profiling Management System authorization bypass in archived records](https://junglewise.ai/threats/cve-2026-78142-barangay-resident-profiling-management-system-authorization)