Executive brief
PHPGurukul Daily Expense Tracker System is a PHP-based web application for tracking personal expenses. An unauthenticated attacker can exploit SQL injection vulnerabilities in the password reset flow to take over any user account without knowing their credentials. The attacker can reset a target user's password and gain full access to their account and expense data.
Technical details
The vulnerability is a pre-authentication SQL injection (CWE-89) in the forgot-password and reset-password flows (/dets/forgot-password.php and /dets/reset-password.php). The affected code directly concatenates unsanitized user input from the email and contactno POST parameters into SQL SELECT and UPDATE queries without using prepared statements or input validation. An attacker can inject SQL via the email field (e.g., email=' OR '1'='1' LIMIT 1-- -) to bypass authentication checks, set arbitrary session variables, and then modify the password reset query to target a specific user. No authentication or email verification is required. The attack is remotely exploitable and has been publicly disclosed. Patches should use parameterized queries and implement secure token-based password reset mechanisms.
Affected products
- PHPGurukul Daily Expense Tracker System 1.1
Timeline
- 2026-08-12: disclosed: Vulnerability disclosed on GitHub by Vy Tien Dat and Hoang Dinh Hieu
- 2026-09-15: advisory: CVE-2026-90846 published