Submit #896122: code-projects Task Management System In PHP 1.0 SQL Injection

The Task Management System in PHP is affected by a potential SQL injection vulnerability in the application's login functionality.

The issue exists in the email parameter processed by:

/PROJECT_NEW/index.php
During authentication, the application receives an email address and password through an HTTP POST request. These values are subsequently used to determine whether the supplied credentials correspond to a valid application account.

The email parameter appears to be incorporated into a backend SQL query without sufficient use of prepared statements or parameter binding. As a result, an attacker may be able to introduce SQL syntax into the value and influence the logical structure of the authentication query.

The provided proof-of-concept request supplies the following value:

[email protected]' or '7333'='7333
This input introduces a boolean condition that always evaluates to true:

'7333'='7333
If the application constructs its SQL authentication statement through direct string concatenation, the injected quotation mark can terminate the intended email string and the subsequent SQL expression can become part of the database query.

A vulnerable authentication pattern may conceptually resemble:

$email = $_POST['email'];
$password = $_POST['password'];

$sql = "SELECT * FROM users
WHERE email = '$email'
AND password = '$password'";

$result = mysqli_query($conn, $sql);
When attacker-controlled input is inserted directly into such a query, SQL operators included in the input may change the intended query logic.

Depending on the precise SQL statement, operator precedence, password condition, and comment handling, successful exploitation could potentially result in authentication bypass. Even where the tested boolean expression does not bypass authentication directly, the ability to influence SQL query logic may indicate a broader SQL injection vulnerability.

If arbitrary SQL injection is confirmed, an unauthenticated attacker may potentially use the vulnerability to retrieve sensitive information from the database, enumerate application accounts, access authentication-related data, or manipulate database records where the database account has sufficient privileges.

Because the affected functionality is located on the application's public login interface, an attacker may be able to interact with the vulnerable parameter without possessing an existing authenticated account.

The root cause is improper separation of untrusted user input from SQL commands. Authentication queries should use prepared statements with parameter binding, and passwords should be securely hashed and verified independently rather than included directly in dynamically constructed SQL queries.

• Source: ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Task%20Management%20System%20in%20PHP%20%E2%80%93%20SQL%20Injection%20in%20%60email%60%20Parameter.md
• User: AhmadMarzook (UID 96211)
• Submission: 07/19/2026 20:27 (2 months ago)
• Moderation: 09/05/2026 12:46 (2 months later)
• Status: Accepted
• VulDB entry: 399312 [code-projects Task Management System In PHP 1.0 Login /index.php email sql injection]
• Points: 20