Executive brief
The Task Management System is a PHP-based web application for managing work tasks and projects. An unauthenticated attacker can inject malicious SQL code through the email parameter in the login page, potentially allowing unauthorized database access, data exfiltration, and system compromise. This vulnerability requires only network access and no user interaction, making it readily exploitable.
Technical details
The vulnerability is a SQL injection flaw in the /index.php login component, specifically in the email parameter. The application fails to properly sanitize or use parameterized queries when processing user input in the email field before constructing SQL queries. An attacker can send a crafted POST request with malicious SQL syntax in the email field to manipulate the database query, potentially bypassing authentication, extracting sensitive data, or modifying database contents. The attack is remotely exploitable via network without prior authentication, and the vulnerability has been publicly disclosed.
Affected products
- code-projects Task Management System In PHP 1.0
Timeline
- 2026-09-06: disclosed: CVE-2026-86180 published
- 2026-09-06: other: Exploit disclosed to the public