{"id":"CVE-2026-114242","kind":"vulnerability","aliases":["CVE-2026-114242"],"related":[],"title":"Insurance-Management-System: SQL injection in editPlan.php lets remote attackers query the database","description":"A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The Insurance-Management-System PHP application passes the Plan_no and Name arguments of /Admin/View/editPlan.php into a mysqli_query call without sanitization. A remote attacker can inject SQL to read or modify the application's database.","severity":"high","cvss":7.5,"epss":0.00328,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","package","php","self-hosted"],"not_affected_if":["admin-not-exposed","not-deployed"],"how_to_check":"- Check whether the deployed code contains /Admin/View/editPlan.php and whether it builds the mysqli_query call from the Plan_no or Name request parameters\n- unknown whether a specific version is affected, since the project uses rolling releases","fix":"- unknown: no fixed version or patched commit is named in the sources\n- Until a fix exists, restrict access to the /Admin path or take the page offline, and switch the query to prepared statements with bound parameters","status":"open","published_at":"2026-10-21T12:17:19+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:57+00:00","updated_at":"2026-10-25T03:16:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:16:57Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: no fixed version or patched commit is named in the sources\n- Until a fix exists, restrict access to the /Admin path or take the page offline, and switch the query to prepared statements with bound parameters","reach":"internet","title":"Insurance-Management-System: SQL injection in editPlan.php lets remote attackers query the database","impact":"high","summary":"The Insurance-Management-System PHP application passes the Plan_no and Name arguments of /Admin/View/editPlan.php into a mysqli_query call without sanitization. A remote attacker can inject SQL to read or modify the application's database.","category":"package","nicknames":[],"who_cares":["php","mysql","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters the insurance database through injected SQL","analyst_note":"Confirm whether the editPlan.php page requires an admin login and whether a patch exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114242 and the project's issue tracker.","how_to_check":"- Check whether the deployed code contains /Admin/View/editPlan.php and whether it builds the mysqli_query call from the Plan_no or Name request parameters\n- unknown whether a specific version is affected, since the project uses rolling releases","needs_analyst":true,"not_affected_if":["not-deployed","admin-not-exposed"],"who_is_affected":"Teams that run the dhikshitha29 Insurance-Management-System code themselves, especially with the Admin pages reachable from the internet. The sources name a specific commit but no released version, and the project has not responded to the report. Teams that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":3466,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114242':17A,20A '-2026':16A,19A '/admin/view/editplan.php':42B,84C '91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837':74C 'affect':75C,125C 'applic':33B,61B 'argument':40B,89C 'attack':11A,52B,97C 'avail':106C 'call':47B 'cve':15A,18A 'databas':14A,63B 'deliveri':119C 'dhikshitha29':69C 'earli':138C 'editplan.php':8A 'execut':100C 'exploit':103C 'file':83C 'function':78C 'host':26B 'identifi':67C 'implement':113C 'inform':123C,134C 'inject':6A,54B,95C 'insur':2A,29B,71C 'insurance-management-system':1A,28B,70C 'issu':141C 'lead':92C 'let':9A 'manag':3A,30B,72C 'manipul':86C 'mean':121C 'might':108C 'modifi':59B 'mysql':21B 'mysqli':45B,79C 'name':39B 'no/name':91C 'ongo':118C 'packag':22B 'pass':34B 'php':23B,32B 'plan':36B,90C 'problem':137C 'product':112C 'project':132C 'public':105C 'queri':12A,46B,80C 'read':57B 'releas':116C,128C 'remot':10A,51B,101C 'report':142C 'respond':146C 'roll':115C 'sanit':49B 'self':25B 'self-host':24B 'sql':5A,55B,94C 'system':4A,31B,73C 'unavail':130C 'updat':127C 'use':110C 'version':122C 'vulner':65C 'without':48B 'yet':147C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the dhikshitha29 Insurance-Management-System code themselves, especially with the Admin pages reachable from the internet. The sources name a specific commit but no released version, and the project has not responded to the report. Teams that do not run this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114242","severity":null,"published_at":"2026-10-21T12:17:19+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114242","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114242","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}