CVE-2026-114254 in file-management-system-php
Summary
by MITRE • 10/21/2026
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The oretnom23 file-management-system-php application contains a critical security flaw within its administrative authentication mechanism, specifically located in the Login function found in the admin_class.php module. This vulnerability arises from improper neutralization of special elements used in an SQL command, commonly known as SQL injection or CWE-89. The root cause is traced to the manipulation of the username and password arguments passed during the login process. Because these inputs are not adequately sanitized or parameterized before being incorporated into database queries, an attacker can inject malicious SQL code that alters the intended logic of the query. This flaw allows for unauthorized access by bypassing authentication controls entirely, which aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts and Authentication Bypass.
The operational impact of this vulnerability is severe due to its remote exploitable nature. An attacker does not need physical or local network proximity to exploit the flaw; instead, they can initiate attacks over a network connection such as the internet. Given that the product follows a rolling release approach for continuous delivery, version tracking is complex and potentially confusing for administrators attempting to assess their exposure. The absence of specific version details means that any instance running code up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 is potentially vulnerable, making it difficult for security teams to determine if their deployment has been patched. The public availability of exploits further exacerbates the risk, as automated scanning tools and malicious actors can readily leverage known attack patterns to compromise systems without requiring custom development effort.
The lack of response from the project maintainers despite early notification through an issue report presents a significant challenge for users relying on this software. In such scenarios where vendor remediation is delayed or non-existent, organizations must implement compensating controls to mitigate risk. Immediate mitigation strategies should include placing the administrative interface behind additional authentication layers such as multi-factor authentication or IP whitelisting if feasible. Additionally, deploying Web Application Firewalls with rules specifically tuned to detect SQL injection patterns can help block malicious payloads before they reach the application logic. Input validation and parameterized queries are essential long-term fixes that developers must implement in future releases to ensure that user-supplied data is treated strictly as data rather than executable code. Until a patched version is available, continuous monitoring of access logs for anomalous authentication attempts is recommended to detect potential exploitation activities early.