SQL Injection in PHPGurukul Daily Expense Tracker System

PHPGurukul Daily Expense Tracker System version 1.1 contains a SQL injection vulnerability within the login component. The vulnerability is located in the '/dets/index.php' file, where the 'email' parameter fails to properly sanitize user-supplied input before passing it to database queries. An unauthenticated remote attacker can supply crafted SQL payloads via the email argument to manipulate back-end queries. This allows for unauthorized data access, potential authentication bypass, or administrative compromise of the underlying database. The vulnerability has been publicly disclosed and is considered exploitable by remote actors. Defenses should focus on monitoring HTTP requests to the identified login endpoint for signs of SQL injection patterns.

Impact

Successful exploitation allows an unauthenticated attacker to interact directly with the application database, potentially resulting in the exfiltration of user credentials, financial records, or system configuration data. In high-privilege scenarios, this may facilitate a full compromise of the application server.

Recommendation

Prioritize remediation by updating or patching the PHPGurukul Daily Expense Tracker System to a version that addresses CVE-2026-90844. As the component is vulnerable to SQL injection, ensure that all input handling in 'index.php' utilizes prepared statements or parameterized queries.