{"id":"CVE-2026-114255","kind":"vulnerability","aliases":["CVE-2026-114255"],"related":[],"title":"oretnom23 file-management-system-php: SQL injection in user account save function","description":"A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The save_user function in admin_class.php of the User Account Management component fails to sanitize the name, username, password, type and id parameters, allowing SQL injection. A remote attacker can read or change database contents, and the exploit is public.","severity":"high","cvss":7.5,"epss":0.00275,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted"],"not_affected_if":["not-deployed"],"how_to_check":"- Check whether the project is deployed by searching the codebase for `admin_class.php` and confirming `save_user` builds SQL from request parameters\n- Confirm the deployed commit: unknown","fix":"- unknown: the project is a rolling release with no fixed version and the maintainer has not responded\n- Until a patch exists, use prepared statements for the save_user queries in admin_class.php or restrict access to the admin user-management pages","status":"open","published_at":"2026-10-21T16:17:32+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:42+00:00","updated_at":"2026-10-25T03:16:42+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:16:42Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the project is a rolling release with no fixed version and the maintainer has not responded\n- Until a patch exists, use prepared statements for the save_user queries in admin_class.php or restrict access to the admin user-management pages","reach":"internet","title":"oretnom23 file-management-system-php: SQL injection in user account save function","impact":"high","summary":"The save_user function in admin_class.php of the User Account Management component fails to sanitize the name, username, password, type and id parameters, allowing SQL injection. A remote attacker can read or change database contents, and the exploit is public.","category":"other","nicknames":[],"who_cares":["php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters user database records remotely","analyst_note":"Confirm whether the save_user route requires a login and whether any fixed commit exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114255.","how_to_check":"- Check whether the project is deployed by searching the codebase for `admin_class.php` and confirming `save_user` builds SQL from request parameters\n- Confirm the deployed commit: unknown","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Deployments of oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 that expose the User Account Management pages are exposed. Teams that do not run this project, or run a later version that has changed this code, are not affected; the sources do not confirm which later versions are safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":3446,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114255':16A,19A '-2026':15A,18A '2e3':80C 'account':11A,34B,96C 'admin_class.php':30B,91C 'affect':142C 'allow':48B 'argument':102C 'attack':53B,109C,127C 'c1ebe60f121e8df4fb3f544f0e9591d9a01e4':81C 'chang':57B 'compon':36B,94C 'content':59B 'cve':14A,17A 'databas':58B 'deliveri':136C 'discov':70C 'earli':155C 'execut':112C 'exploit':62B,115C 'fail':37B 'file':3A,74C,90C 'file-management-system-php':2A,73C 'flaw':67C 'function':13A,28B,85C 'host':24B 'id':46B 'impact':83C 'implement':130C 'inform':140C,151C 'inject':8A,50B,107C 'issu':158C 'manag':4A,35B,75C,97C 'manipul':99C 'may':123C 'mean':138C 'name':41B 'name/username/password/type/id':103C 'ongo':135C 'oretnom23':1A,72C 'paramet':47B 'password':43B 'php':6A,21B,77C 'problem':154C 'product':129C 'project':149C 'public':64B,121C 'read':55B 'releas':118C,133C,145C 'remot':52B,113C 'report':159C 'respond':163C 'result':104C 'roll':132C 'sanit':39B 'save':12A,26B,86C 'secur':66C 'self':23B 'self-host':22B 'sql':7A,49B,106C 'system':5A,76C 'type':44B 'unavail':147C 'updat':144C 'use':125C 'user':10A,27B,33B,87C,95C 'usernam':42B 'version':139C 'yet':164C","nicknames":[],"mitigations":[],"who_affected":"Deployments of oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 that expose the User Account Management pages are exposed. Teams that do not run this project, or run a later version that has changed this code, are not affected; the sources do not confirm which later versions are safe.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114255","severity":null,"published_at":"2026-10-21T16:17:32+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114255","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114255","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}