SQL Injection Vulnerability in code-projects Task Management System

A vulnerability has been identified in the code-projects Task Management System version 1.0, specifically within the Login Form component. The vulnerability resides in the Operation::select_with_multiple_condition function found in the /index.php file. An unauthenticated remote attacker can exploit this flaw by manipulating the email argument during the authentication process. Because the input is not properly neutralized, it leads to SQL injection, allowing for unauthorized database interaction. The vulnerability is assigned CVE-2026-75778 and has been confirmed to have publicly available exploit code, increasing the likelihood of opportunistic exploitation against exposed instances.

Attack Chain

1. Attacker performs reconnaissance to identify instances of code-projects Task Management System 1.0.
2. Attacker navigates to the login page hosted by the vulnerable application.
3. Attacker crafts a malicious payload containing SQL injection sequences (e.g., ' OR 1=1 --).
4. Attacker submits the malicious payload via the email parameter in the login form POST request.
5. The server-side code in /index.php processes the unsanitized input within the Operation::select_with_multiple_condition function.
6. The injection triggers the execution of arbitrary SQL commands against the application's backend database.
7. Attacker achieves unauthorized data access, modification, or potentially full database compromise.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands. This can lead to the unauthorized disclosure of sensitive information, data manipulation, or denial of service of the backend database. Given the nature of the application as a Task Management System, exposed databases likely contain project details, user credentials, and internal communications, posing a significant risk to organizational confidentiality and integrity.

Recommendation

Prioritized actions for security teams:

• Identify and inventory all instances of code-projects Task Management System 1.0 within the environment.
• Implement a web application firewall (WAF) rule to inspect and block HTTP POST requests containing SQL injection patterns in the email parameter of the login form.
• Deploy the provided Sigma rule to detect attempts to reach the vulnerable endpoint with suspicious query parameters.
• Patch the application immediately or restrict access to the application to trusted networks if a patch is not available.