CVE-2026-90846 in Daily Expense Tracker System
Summary
by MITRE • 09/15/2026
A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The PHPGurukul Daily Expense Tracker System version 1.1 contains a critical security flaw located within the forgot-password functionality, specifically in the file dets/forgot-password.php. This vulnerability arises from improper input validation and sanitization of user-supplied data passed through the email or contact number arguments. When an attacker submits specially crafted input for these fields, the application fails to properly escape special characters before incorporating them into SQL queries executed against the backend database. This lack of parameterized query usage allows malicious actors to inject arbitrary SQL commands directly into the authentication and password recovery logic.
This flaw constitutes a classic instance of SQL Injection, categorized under CWE-89 in the Common Weakness Enumeration standards. The vulnerability enables remote code execution at the database level without requiring prior authentication, classifying it as an unauthenticated attack vector. According to the MITRE ATT&CK framework, this behavior aligns with techniques involving Database Credential Harvesting and potentially Data Exfiltration via SQL Injection. Because the exploit is publicly disclosed and functional, automated scanning tools and malicious actors can readily leverage this weakness to compromise the integrity of the system's data store.
The operational impact of this vulnerability is severe, as it allows attackers to bypass access controls, retrieve sensitive user information such as hashed passwords or personal identifiable information stored in the expense tracker database, modify records, or even drop tables depending on the privileges granted to the database account used by the web application. In many deployment scenarios, if the database service runs with elevated permissions, an attacker could potentially execute operating system commands through specific SQL functions like xp_cmdshell in Microsoft SQL Server or similar extensions in other database management systems, leading to full server compromise.
Mitigation strategies must focus on immediate remediation of the source code and defensive configuration changes. The primary fix involves refactoring the affected PHP script to use prepared statements with parameterized queries for all database interactions involving user input. This ensures that data is treated strictly as values rather than executable SQL code, effectively neutralizing injection attempts. Additionally, implementing strict input validation on both client-side and server-side levels can provide defense in depth by rejecting unexpected character patterns before they reach the query builder layer.
Beyond code fixes, organizations should enforce principle of least privilege for database accounts used by web applications to limit the potential damage if an injection succeeds. Regular security audits using static application security testing tools and dynamic analysis during development cycles are essential to detect such flaws early. Given that this exploit is known and active in the wild, immediate patching or upgrading to a secure version of the Daily Expense Tracker System is critical to prevent unauthorized access and data breaches.