{"id":"CVE-2026-114254","kind":"vulnerability","aliases":["CVE-2026-114254"],"related":[],"title":"oretnom23 file-management-system-php: login SQL injection allows database access","description":"A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The Login function in admin_class.php of oretnom23 file-management-system-php does not sanitize the username and password fields before using them in SQL queries. A remote attacker can inject SQL to read or modify the application's database, and a public exploit exists.","severity":"high","cvss":7.5,"epss":0.00343,"exploited":false,"exploited_at":null,"products":[{"name":"file-management-system-php","fixed":[],"affected":"<= commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4","ecosystem":"github"}],"ecosystems":[],"tags":["auth-bypass","file-management","no-patch","package","php","self-hosted","sql-injection"],"not_affected_if":["login-not-reachable","network-restricted","patched-code"],"how_to_check":"Open admin_class.php and look at login(). If it builds SELECT * FROM users where username = '$username' and password = '$password' by string concatenation, it is vulnerable. Test on your own instance: curl -s -d \"username=nobody&password=wrong\" $BASE/ajax.php?action=login returns 2. Then send username=admin' or '1'='1' limit 1 -- - and if it returns 1, you are exposed. Upstream commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier are affected.","fix":"No fix exists: the maintainer has not responded and the project has no releases. Replace the query in admin_class.php login() with a prepared statement (mysqli bind_param), hash passwords, and change the seeded admin/admin123 account. Put the app behind a VPN or IP allowlist, or stop using it.","status":"open","published_at":"2026-10-21T16:17:32+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:43+00:00","updated_at":"2026-10-25T03:23:39+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-25T03:16:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"oretnom23 file-management-system-php: login SQL injection allows database access","impact":"high","summary":"The Login function in admin_class.php of oretnom23 file-management-system-php does not sanitize the username and password fields before using them in SQL queries. A remote attacker can inject SQL to read or modify the application's database, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["php","self-hosted","file-management"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads or changes the application database through login","analyst_note":"Check the upstream repository for a fix commit or workaround; the sources give no fixed version and the maintainer has not responded.","how_to_check":"- Look for `admin_class.php` in the application and check whether the Login function builds SQL from the `username` or `password` POST values without parameter binding.\n- Compare the deployed code against the upstream commit `2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4`; the project has no release versions.","needs_analyst":true,"not_affected_if":["login-not-reachable","patched-code"],"who_is_affected":"Any deployment of oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 that exposes its login form to the network is exposed. The sources do not name a patched version and the project has not responded to the report, so teams running this code should restrict access or replace the login logic.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000624,"input_tokens":3458,"output_tokens":557,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the upstream repository for a fix commit or workaround; the sources give no fixed version and the maintainer has not responded.","search":"'-114254':15A,18A '-2026':14A,17A '2e3':99C 'access':12A 'admin_class.php':45B,109C 'affect':102C,150C 'allow':10A 'applic':78B 'approach':142C 'argument':114C 'attack':69B,124C 'auth':25B 'auth-bypass':24B 'avail':131C 'bypass':26B 'c1ebe60f121e8df4fb3f544f0e9591d9a01e4':100C 'continu':144C 'cve':13A,16A 'databas':11A,80B 'deliveri':145C 'detail':148C 'earli':164C 'exist':85B 'exploit':84B,121C,128C 'field':60B 'file':3A,20A,28B,49B,93C,108C 'file-manag':27B 'file-management-system-php':2A,19A,48B,92C 'follow':138C 'function':43B,104C 'host':37B 'identifi':89C 'inform':160C 'inject':9A,40B,71B,119C 'issu':167C 'lead':116C 'login':7A,42B,105C 'manag':4A,29B,50B,94C 'management':21A 'manipul':111C 'might':133C 'modifi':76B 'no-patch':30B 'oretnom23':1A,47B,91C 'packag':33B 'password':59B 'patch':32B 'php':6A,23A,34B,52B,96C 'possibl':126C 'problem':163C 'product':137C 'project':158C 'provid':156C 'public':83B,130C 'queri':66B 'read':74B 'releas':141C,153C 'remot':68B,120C 'report':168C 'respond':172C 'roll':140C 'sanit':55B 'self':36B 'self-host':35B 'sql':8A,39B,65B,72B,118C 'sql-inject':38B 'system':5A,22A,51B,95C 'updat':152C 'use':62B,135C 'usernam':57B 'username/password':115C 'version':147C 'vulner':87C 'yet':173C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 that exposes its login form to the network is exposed. The sources do not name a patched version and the project has not responded to the report, so teams running this code should restrict access or replace the login logic.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-114254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114254","severity":null,"published_at":"2026-10-21T16:17:32+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114254","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114254","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114254:706","url":null,"severity":null,"published_at":"2026-10-25T03:23:39+00:00","modified_at":"2026-10-25T03:23:39+00:00","first_seen_at":"2026-10-25T03:23:39+00:00","fetched_at":"2026-10-25T03:23:39+00:00","note":"Read the CVE record and the public GitHub issue #2 (PoC, unauthenticated admin login bypass plus UNION dump). No fix, no maintainer response, rolling release. Not marked verified: no vendor advisory exists. Siblings CVE-2026-114255/58/59 are in the same app."}],"documents":[{"id":3143,"url":"https://github.com/oretnom23/file-management-system-php/issues/2","title":"SQL injection in admin_class.php login() (issue #2)","kind":"issue","source":"analyst","text":"Open issue 2026-10-07 by ThanatosXingYu. Commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. login() concatenates POST username/password into SELECT * FROM users; payload username=admin' or '1'='1' limit 1 -- - via /ajax.php?action=login returns 1 and gives admin session. UNION can dump users table (plaintext passwords). Seed admin/admin123. No maintainer response.","published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3144,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114254","title":"CVE record CVE-2026-114254 (VulDB CNA)","kind":"advisory","source":"analyst","text":"Affected at 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4; rolling release, no fixed version; project informed via issue, no response. Reporter Zeming Hu. CWE-89.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}