CVE-2026-5543

Vulnerability

Overview

The vulnerability is an SQL injection in the /admin/yesterday-reg-users.php file of PHPGurukul User Registration & Login and User Management System version 3.3. The issue arises because the id parameter received via GET request is directly used in SQL queries without proper sanitization or validation [2]. This allows an attacker to inject malicious SQL code.

Exploitation

Details

The attack vector is remote, requiring no authentication (though the file is in an admin directory). The attacker sends a crafted GET request to /admin/yesterday-reg-users.php with a malicious id parameter. The lack of input validation means the injected SQL is executed by the database server [2]. Public exploit code is available, increasing the risk.

Impact

Successful exploitation can lead to unauthorized access to the database, leakage of sensitive user data, modification or deletion of records, and potentially full control over the application and underlying server. This compromises confidentiality, integrity, and availability of the system [2].

Mitigation

As of the report, no official patch has been released for version 3.3. Users should apply input validation and parameterized queries (e.g., using PDO or prepared statements) to mitigate the vulnerability. Given the public exploit, immediate action is recommended.