SQL Injection Vulnerability in College-Notes-Gallery

A SQL injection vulnerability has been identified in the anirbandutta9 College-Notes-Gallery project, affecting all versions up to the commit hash 8c1cf3d98f30982d069c88ca172612c001eb39f6. The vulnerability resides in the login.php file and stems from improper sanitization of the 'user' and 'pass' input parameters. An unauthenticated remote attacker can supply maliciously crafted input to these arguments to interfere with backend database queries. If successfully exploited, this flaw could allow attackers to bypass authentication mechanisms, perform unauthorized data exfiltration, or modify application data. The project follows a rolling release model, and no specific patches were provided by the vendor upon disclosure. Defenders should monitor web server logs for suspicious SQL syntax in authentication requests targeting the login.php endpoint.

Impact

Successful exploitation of CVE-2026-95819 enables unauthorized access to the underlying database, potentially resulting in complete compromise of user credentials or the loss of sensitive data stored within the College-Notes-Gallery application. The vulnerability is exploitable remotely without prior authentication, posing a significant risk to any instance of the application exposed to the internet.

Recommendation

1. Audit all instances of College-Notes-Gallery to ensure they are not exposed to the public internet until the codebase can be manually secured or replaced.
2. Implement WAF rules to detect and block SQL injection patterns (such as ' or 1=1--, UNION SELECT, etc.) targeting the /login.php endpoint.
3. Deploy the provided Sigma rule to monitor for SQL injection attempts against the application.
4. Manually review the login.php file to implement prepared statements for all database queries involving the 'user' and 'pass' parameters.