CVE-2026-7143

The vulnerability exists in /admin/block_status.php and /admin/unblock_me.php of the 1000 Projects Portfolio Management System MCA version 1.0. The q parameter is base64-decoded and directly concatenated into an SQL UPDATE statement without sanitization or parameterization, leading to SQL injection [2].

An attacker can exploit this by crafting a malicious base64-encoded string in the q parameter. The attack is remotely exploitable and, while an admin session is normally required, the reference notes that authentication can be bypassed [2]. Public exploit code is available, increasing the risk of widespread attacks.

Successful exploitation allows an attacker to arbitrarily block or unblock any user account by modifying the block_status column in the reg_details table. This can lead to denial of service for legitimate users or unauthorized elevation of privileges if admins are blocked [2].

No official patch has been released as of the publication date. The vendor has not responded to the disclosure. Mitigation requires implementing prepared statements or input validation. Given the availability of public exploit code, this vulnerability may be added to CISA's Known Exploited Vulnerabilities (KEV) catalog in the future.