CVE-2026-4970

Vulnerability

Details

The delete_photos.php endpoint in code-projects Social Networking Site v1.0 contains a SQL injection vulnerability. The application directly inserts the user-supplied id parameter from the HTTP request into a DELETE query without any sanitization, validation, or parameterization. This unsafe query construction (CWE-89) allows an attacker to inject arbitrary SQL code [1].

Exploitation

The attack can be performed remotely by sending a crafted HTTP GET request to the delete_photos.php file with a malicious id parameter. Testing has confirmed that the injection point supports time-based SQL injection, meaning the attacker can extract information by observing database response delays. No authentication is required to trigger the vulnerability [1].

Impact

Successful exploitation enables an attacker to execute arbitrary SQL commands on the backend database. This could lead to unauthorized access, theft, modification, or deletion of user data, including personal information and photos stored on the social networking platform [1].

Mitigation

As of the publication date, no patch has been released by the vendor. Users of code-projects Social Networking Site v1.0 should apply proper input validation and use parameterized queries (prepared statements) to prevent SQL injection. Given that the exploit has been published, the application is at high risk and should be updated or replaced [1].