Executive brief
A security vulnerability exists in the code-projects Project Management System, a tool used for managing organizational tasks and projects. An attacker can bypass the login screen by entering specially crafted text into the username field, allowing them to gain full administrative access to the system. This could lead to the unauthorized viewing of sensitive project data, modification of records, or complete loss of control over the management platform.
Technical details
A SQL injection vulnerability exists in the 'chk.php' file of code-projects Project Management System 1.0. The application fails to properly sanitize user input in the identity authentication module, specifically when processing login credentials. An unauthenticated remote attacker can exploit this by submitting a malicious SQL payload (e.g., 'OR '1'='1' -- q) in the account ID field. Because the system does not strongly bind account verification to password logic, this manipulation allows the attacker to bypass authentication entirely and log in as an administrator. A public exploit (PoC) has been disclosed.
Affected products
- code-projects Project Management System 1.0
Timeline
- 2026-05-26: disclosed: Public disclosure of the vulnerability and exploit details.
- 2026-05-26: advisory: NVD published the CVE record.