SQL Injection Authentication Bypass in Code-Projects Task Management System (CVE-2025-0846)

SQL Injection Authentication Bypass in Code-Projects Task Management System Admin Login #2 Vulnerability Overview Affected Product: Task Management System in PHP With Source Code Vendor: Code-Projects Affected Versions: Package downloadable on June 22, 2026 (no specific version identifier) Vulnerability Type: SQL injection leading to administrator authentication bypass Vulnerable Component: Affected Parameters: , Root Cause: The administrator login handler reads attacker-controlled POST parameters and concatenates them into SQL conditions, executing the query without parameter binding. Impact An unauthenticated remote attacker can bypass administrator authentication and obtain an authenticated administrator session. This exposes administrative functionalities, including user management, task management, project management, and account modification. Remediation 1. Replace string-concatenated SQL with prepared statements and bound parameters. 2. Retrieve administrator accounts by email and active status. 3. Store passwords using . 4. Verify passwords using . 5. Generate and create an authenticated session only after successful verification. 6. Disable detailed PHP errors in production environments. Example Remediation Code Proof of Concept (POC) Read-Only UNION SELECT Payload URL-Encoded Request Observations Regenerated Session Accesses Admin Interface Response Renders Admin Dashboard and All Task Interfaces Testing Environment Attacker: macOS with Yakit Target: Windows 64-bit with Apache 2.4.58 and PHP 8.2.12 Protocol: HTTP Attack Type: Remote and unauthenticated Test Date: June 22, 2026 Existing CVE Assignment CVE-2025-0846: Documents SQL injection via the parameter in .

Goal Reached Thanks to every supporter — we hit 100%!

SQL Injection Authentication Bypass in Code-Projects Task Management System (CVE-2025-0846)

More from this source