---
id: "CVE-2026-114242"
kind: "vulnerability"
aliases: ["CVE-2026-114242"]
title: "Insurance-Management-System: SQL injection in editPlan.php lets remote attackers query the database"
severity: "high"
cvss: 7.5
epss: 0.00328
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mysql", "package", "php", "self-hosted"]
not_affected_if: ["admin-not-exposed", "not-deployed"]
published_at: "2026-10-21T12:17:19+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:16:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114242", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114242", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Insurance-Management-System: SQL injection in editPlan.php lets remote attackers query the database

The Insurance-Management-System PHP application passes the Plan_no and Name arguments of /Admin/View/editPlan.php into a mysqli_query call without sanitization. A remote attacker can inject SQL to read or modify the application's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployed code contains /Admin/View/editPlan.php and whether it builds the mysqli_query call from the Plan_no or Name request parameters
- unknown whether a specific version is affected, since the project uses rolling releases

## Fix

- unknown: no fixed version or patched commit is named in the sources
- Until a fix exists, restrict access to the /Admin path or take the page offline, and switch the query to prepared statements with bound parameters

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114242
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114242

## From the sources

A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_