CVE-2026-114242
Deferred Deferred - Pending Action

SQL Injection in Insurance Management System

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulDB

Description
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Such manipulation of the argument Plan_no/Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-27
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-114242
EUVD
EUVD-2026-107179

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183
dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated SQL injection flaw in the Insurance Management System. It exists in the file Admin/View/editPlan.php where user-controlled input from Plan_no and Name GET parameters is directly concatenated into a SQL query without validation or sanitization. This allows attackers to inject malicious SQL commands remotely without authentication.

Detection Guidance

To detect this SQL injection vulnerability, inspect the Insurance-Management-System for unauthenticated access to /Admin/View/editPlan.php. Check if Plan_no or Name GET parameters are directly used in SQL queries without validation. Test by appending SQL payloads like ' OR '1'='1 to these parameters and observe if the application responds with database errors or unexpected data.

Impact Analysis

An attacker could exploit this to extract sensitive data from the database, modify or delete records, or potentially gain full control of the application and its data. Since no authentication is required, any user with network access to the system could launch this attack.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access and potential data breaches. GDPR mandates protection of personal data while HIPAA requires safeguards for protected health information. The flaw enables unauthorized data exposure which could result in regulatory penalties.

Mitigation Strategies

Immediately restrict access to /Admin/View/editPlan.php by implementing proper authentication checks in Admin/header.php. Sanitize all user inputs (Plan_no/Name) using prepared statements or input validation. Update the application to use parameterized queries to prevent SQL injection. Monitor network traffic for suspicious requests targeting this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...