Description

A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The manipulation of the argument user_name results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T05:16:50.673Z",
  "pubdate": "2026-09-06T05:16:50.673Z",
  "executiveSummary": "A critical SQL injection (SQLi) vulnerability has been identified in code-projects Content Management System 1.0, specifically residing within the /login.php file.\nThe flaw allows unauthenticated remote attackers to manipulate the 'user_name' parameter to inject malicious SQL commands directly into the application's database queries.\nSuccessful exploitation grants an attacker the ability to bypass authentication, access, modify, or delete sensitive data stored within the backend database, and potentially achieve full system compromise.\nGiven that the exploit is publicly available, the risk to installations of this CMS version is critical, as no authentication is required to initiate the attack.\nOrganizations utilizing this CMS are at high risk of data breaches and unauthorized administrative access until the vulnerability is addressed.",
  "technicalDetails": "The vulnerability originates from improper input validation and sanitization of the 'user_name' parameter in the /login.php file. The application fails to utilize prepared statements or parameterized queries when handling user-supplied input before passing it to the database management system.\nAn attacker can exploit this by sending a crafted HTTP POST request to /login.php, injecting SQL syntax into the 'user_name' field. For example, by inserting a single quote followed by union-based or boolean-based SQL commands, the attacker can force the database to execute arbitrary queries outside the intended scope of the login mechanism.\nThe attack flow follows these steps: 1) The attacker targets the login portal at /login.php. 2) The attacker submits a malicious string within the 'user_name' parameter designed to break the query logic (e.g., ' OR 1=1--). 3) The backend server processes this unsanitized string within the SQL statement, effectively altering the logic of the query to bypass the password check or return information from other tables.\nBecause the input is processed directly by the database, the impact extends beyond mere authentication bypass. Attackers can leverage UNION operators to extract data from other system tables, including usernames, hashed passwords, or configuration settings. Furthermore, depending on the database configuration and permissions, an attacker may be able to perform administrative operations, read system files, or write backdoors to the filesystem.\nThis vulnerability is classified as remote and unauthenticated, meaning no prior access or interaction with legitimate users is necessary. The exploit's public availability significantly lowers the barrier to entry for potential adversaries, allowing for automated scanning and mass exploitation efforts. The lack of parameterized queries at the primary authentication entry point represents a fundamental failure in secure coding practices, specifically regarding the handling of untrusted user input."
}