---
id: "CVE-2026-114254"
kind: "vulnerability"
aliases: ["CVE-2026-114254"]
title: "oretnom23 file-management-system-php: login SQL injection allows database access"
severity: "high"
cvss: 7.5
epss: 0.00343
exploited: false
status: "open"
category: "package"
products: [{"name": "file-management-system-php", "fixed": [], "affected": "<= commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4", "ecosystem": "github"}]
ecosystems: []
tags: ["auth-bypass", "file-management", "no-patch", "package", "php", "self-hosted", "sql-injection"]
not_affected_if: ["login-not-reachable", "network-restricted", "patched-code"]
published_at: "2026-10-21T16:17:32+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:23:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114254", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114254", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:23:39+00:00"}]
---

# oretnom23 file-management-system-php: login SQL injection allows database access

The Login function in admin_class.php of oretnom23 file-management-system-php does not sanitize the username and password fields before using them in SQL queries. A remote attacker can inject SQL to read or modify the application's database, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:file-management-system-php affected <= commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 fixed ?

## How to check

Open admin_class.php and look at login(). If it builds SELECT * FROM users where username = '$username' and password = '$password' by string concatenation, it is vulnerable. Test on your own instance: curl -s -d "username=nobody&password=wrong" $BASE/ajax.php?action=login returns 2. Then send username=admin' or '1'='1' limit 1 -- - and if it returns 1, you are exposed. Upstream commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier are affected.

## Fix

No fix exists: the maintainer has not responded and the project has no releases. Replace the query in admin_class.php login() with a prepared statement (mysqli bind_param), hash passwords, and change the seeded admin/admin123 account. Put the app behind a VPN or IP allowlist, or stop using it.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114254
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114254
- 2026-10-25T03:23:39+00:00 analyst — Read the CVE record and the public GitHub issue #2 (PoC, unauthenticated admin login bypass plus UNION dump). No fix, no maintainer response, rolling release. Not marked verified: no vendor advisory exists. Siblings CVE-2026-114255/58/59 are in the same app.

## Documents

- [advisory] CVE record CVE-2026-114254 (VulDB CNA) https://www.cve.org/CVERecord?id=CVE-2026-114254
- [poc] SQL injection in admin_class.php login() (issue #2) https://github.com/oretnom23/file-management-system-php/issues/2

## From the sources

A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_