CVE-2026-6202

A SQL injection vulnerability exists in code-projects Easy Blog Site version 1.0. The flaw. The issue is in the post.php file, where the tags GET parameter is directly concatenated into SQL queries without any sanitization or validation [1]. This root cause allows an attacker to inject arbitrary SQL commands through the tags input.

The attack can be initiated remotely without requiring authentication or any special privileges [1]. An attacker simply sends a crafted HTTP GET request to the vulnerable post.php script with malicious SQL in the tags parameter. Proof-of-concept exploit code has been publicly released, demonstrating both boolean-based blind injection techniques [1].

The impact of successful exploitation is severe: an attacker can gain unauthorized access to the underlying database, extract sensitive data (e.g., user credentials, personal information), modify existing data, and under certain conditions achieve complete system compromise or service disruption [1]. Since this is a PHP application with direct database interactions, a successful injection could lead to data leakage, tampering, or service disruption [1].

As of the latest public disclosure, no official patch has been released by the vendor for Easy Blog Site 1.0 [2]. Users of this project are advised to implement input validation and parameterized queries in post.php, or migrate to a supported and maintained blog platform to mitigate this risk [1].