CVE-2026-114255 in file-management-system-php
Summary
by MITRE • 10/21/2026
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in oretnom23 file-management-system-php represents a critical security flaw within the User Account Management component, specifically affecting the save_user function located in the admin_class.php module. This software utilizes a rolling release model for ongoing delivery, which complicates precise version tracking and means that specific affected versions cannot be definitively listed beyond those preceding commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The core technical deficiency lies in the inadequate sanitization of user-supplied input arguments, including name, username, password, type, and id fields. When these parameters are processed by the save_user function, they are directly incorporated into SQL queries without proper validation or parameterization, creating a classic injection vector that allows an attacker to manipulate the underlying database structure or extract sensitive data.
This flaw is categorized under CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The vulnerability enables remote code execution at the database level, allowing attackers to bypass authentication mechanisms, modify user credentials, or exfiltrate confidential information stored within the system's backend. Because the administrative interface is typically accessible over a network, this attack can be executed remotely by any authenticated or potentially unauthenticated user depending on the specific access controls implemented in the deployment environment. The presence of publicly released exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated attacks and widespread compromise across instances running vulnerable versions of the software.
From an operational perspective, the impact of this vulnerability extends beyond simple data theft. Successful exploitation can lead to a complete loss of integrity within the application's user management system. Attackers may create administrative accounts with elevated privileges, effectively taking control of the file management platform. This aligns with ATT&CK technique T1078, Valid Accounts, where adversaries use legitimate credentials or created accounts to maintain persistent access and move laterally within a network infrastructure. The lack of response from the project maintainers despite early notification via issue reports exacerbates the risk, as users are left without official patches or guidance on remediation strategies during this window of exposure.
Mitigation efforts must focus on immediate defensive measures since automated patching is not available due to the rolling release nature and unresponsive development team. Administrators should implement Web Application Firewall rules that detect and block SQL injection patterns within POST requests targeting the admin_class.php endpoint, particularly focusing on the save_user function parameters. Additionally, enforcing strict input validation at the application layer by whitelisting allowed characters for username and name fields can reduce the attack surface. If possible, migrating to a version of the software where this issue has been addressed or transitioning to an alternative file management solution with active security maintenance is strongly recommended until the project provides a verified fix. Regular auditing of database queries and implementing parameterized statements in future development cycles are essential practices to prevent recurrence of such injection vulnerabilities.