Executive brief
code-projects is an open-source Content Management System (CMS) used for building and managing websites. A SQL injection vulnerability in the login page allows attackers to bypass authentication or extract sensitive data from the underlying database without requiring valid credentials, potentially leading to unauthorized access and data breach.
Technical details
The vulnerability is a SQL injection flaw in the /login.php file's user_name parameter. The affected component fails to properly sanitize or parameterize user input before passing it to SQL queries, allowing an attacker to inject arbitrary SQL commands. The attack vector is network-based and requires no authentication—an attacker can craft a malicious POST request to the login endpoint with a specially crafted user_name value. Successful exploitation allows attackers to bypass authentication, enumerate the database, exfiltrate sensitive data, or potentially gain code execution depending on database permissions. Remediation requires using prepared statements/parameterized queries, input validation, and applying least-privilege database permissions.
Affected products
- code-projects Content Management System 1.0
Timeline
- 2026-09-06: disclosed
- exploited: Exploit released to public