CVE-2026-114255
Deferred Deferred - Pending Action

SQL Injection in File Management System PHP

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulDB

Description
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-28
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-114255
EUVD
EUVD-2026-107325

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-114255 is an unauthenticated SQL injection flaw in the save_user() function of the file-management-system-php application. It allows attackers to create or overwrite administrator accounts without authentication by exploiting improperly concatenated SQL queries in admin_class.php. The attack is executed via crafted POST requests to ajax.php?action=save_user with parameters like name, username, password, and type=1 (admin role).

Detection Guidance

Check for suspicious POST requests to ajax.php with action=save_user and parameters like name, username, password, and type=1. Monitor database logs for unauthorized user creation or modifications. Inspect admin_class.php for SQL query concatenation without sanitization.

Impact Analysis

This vulnerability allows attackers to gain full administrative access to the application, compromising confidentiality, integrity, and availability. Attackers can create privileged accounts, overwrite existing ones, reset passwords, and manipulate user data. The exploit is remotely executable without authentication.

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR (data protection) and HIPAA (health data security) due to unauthorized access to sensitive data, potential data breaches, and lack of proper access controls. It compromises data integrity and confidentiality, which are core requirements.

Mitigation Strategies

Apply input validation and sanitization to all user-supplied data. Implement prepared statements for SQL queries. Add authentication and authorization checks before processing save_user requests. Disable or restrict access to ajax.php if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114255. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...