Description

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T08:16:41.910Z",
  "pubdate": "2026-09-06T08:16:41.910Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the Task Management System in PHP 1.0. The vulnerability resides within the login functionality of /index.php, where the 'email' parameter fails to properly sanitize user-supplied input before being processed by the backend database.\nThis flaw allows a remote, unauthenticated attacker to manipulate SQL queries, potentially leading to unauthorized data exposure, bypass of authentication mechanisms, or compromise of the database management system.\nThe vulnerability is currently publicly disclosed, increasing the risk of active exploitation. Given that the system lacks adequate input validation, the threat level is severe, as it permits attackers to interact directly with the database layer without requiring prior system access or valid credentials. Organizations utilizing this version should treat this as a high-priority security issue, as exploitation can result in full database exfiltration or administrative account takeover.",
  "technicalDetails": "The vulnerability is categorized as a classic SQL injection flaw located in the /index.php file of the Task Management System in PHP 1.0. The root cause is the improper neutralization of special elements used in an SQL command within the authentication module.\nWhen a user submits their credentials via the login form, the application accepts an 'email' argument that is directly concatenated into a SQL SELECT query without the use of prepared statements, parameterization, or context-aware escaping. This architectural failure allows an attacker to inject arbitrary SQL syntax into the query string.\nThe attack flow begins with the attacker crafting a malicious payload within the 'email' input field. By injecting characters such as single quotes ('), semicolons (;), or comment identifiers (like -- or #), the attacker can terminate the intended query and append malicious SQL commands. For example, an attacker could input ' OR '1'='1' as the email address to force the application to evaluate the query as true, potentially bypassing authentication mechanisms and gaining unauthorized access to the application as an administrative user.\nBeyond authentication bypass, the vulnerability exposes the backend database to union-based or error-based SQL injection techniques. An attacker can leverage UNION SELECT statements to extract data from other tables within the database, such as user credentials, password hashes, or sensitive project information. Because the application processes this input directly through the web interface, the attack is fully remote and does not require pre-existing privileges.\nThe component affected is the Login module, which handles the validation of user identity. By targeting the 'email' parameter, the attacker effectively interacts with the application's database driver. The impact of successful exploitation is significant, potentially leading to a complete compromise of the database integrity and confidentiality. Since the payload is executed server-side, the database's permissions determine the scope of damage; if the database user has excessive privileges, the attacker may also be able to read or modify files on the server or execute operating system-level commands, depending on the database configuration."
}