| शीर्षक | code-projects Task Management System In PHP With Source Code 1.0 Improper Authentication |
|---|
| विवरण | A remote authentication bypass vulnerability exists in the user login functionality of Code-Projects Task Management System In PHP With Source Code.
The vulnerable login handler is located in /index.php. It accepts the POST parameters email and password, but the database query validates only user_email and user_status. The submitted password is never compared with the stored user_password value.
An unauthenticated remote attacker who knows the email address of an active user can submit an arbitrary password. The application creates an authenticated PHP session and redirects the attacker to user/UserHome.php.
Proof of concept request:
POST /PROJECT_NEW/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
email=priyanka%40gmail.com&password=CVE-PoC-Invalid-2026%21&submit=1
Successful response:
HTTP/1.1 302 Found
Location: user/UserHome.php
Set-Cookie: PHPSESSID=[REDACTED]
The issue is remotely exploitable, requires no prior authentication, and requires no SQL injection payload.
CVE-2025-0847 documents SQL injection through the email parameter in the same endpoint and source-code lineage. This submission concerns a distinct authentication logic vulnerability: the password is entirely omitted from authentication validation.
Vendor contact:
Code-Projects was contacted by email at [email protected] on 2026-06-22. The report was sent from [email protected]. A response is currently pending.
Public advisory:
https://github.com/littleRain1355/PHPissue/issues/1
Product:
https://code-projects.org/task-management-system-in-php-with-source-code/
Package SHA-256:
8a4bf7950b97ea99e05ff9655185678fc1b13b5d79099f3aa7060dd438ac1d54 |
|---|
| स्रोत | ⚠️ https://github.com/littleRain1355/PHPissue/issues/1 |
|---|
| उपयोगकर्ता | rainless100792 (UID 84115) |
|---|
| सबमिशन | 22/06/2026 02:31 PM (2 महीनों पहले) |
|---|
| संयम | 08/08/2026 03:32 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 387178 [code-projects Task Management System 1.0 Login /index.php पासवर्ड कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|