CVE-2026-3057
SQL Injection in pearProjectApi Backend Allows Remote Exploits
Publication date: 2026-02-24
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| a54552239 | pearprojectapi | to 2.8.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3057 is a SQL injection vulnerability in the pearProjectApi software up to version 2.8.10. It exists in the function dateTotalForProject within the file application/common/Model/Task.php of the Backend Interface component. The vulnerability arises because the argument projectCode is user-controlled and is concatenated directly into an SQL query without any filtering or sanitization. This allows an attacker to inject malicious SQL code remotely by manipulating the projectCode parameter.
The vulnerability can be exploited by sending specially crafted requests to the endpoint /index.php/project/Task/dateTotalForProject, which can lead to unauthorized access to sensitive database information.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can impact you by allowing remote attackers to perform SQL injection attacks on your pearProjectApi system. Exploiting this flaw can compromise the confidentiality, integrity, and availability of your database and system.'}, {'type': 'list_item', 'content': 'Attackers can retrieve sensitive information from the database.'}, {'type': 'list_item', 'content': 'Attackers can manipulate or corrupt data.'}, {'type': 'list_item', 'content': "The system's availability may be affected due to malicious queries."}, {'type': 'paragraph', 'content': 'The attack is easy to execute remotely without authentication, and a public proof-of-concept exploit is available, increasing the risk of exploitation.'}] [1, 2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted POST request to the endpoint /index.php/project/Task/dateTotalForProject with parameters including beginTime, endTime, and a specially crafted projectCode value to test for SQL injection.
A practical detection method involves saving such a crafted request in a file (e.g., x.txt) and running sqlmap with the command: python sqlmap.py -r x.txt --batch --current-db to confirm the presence of SQL injection and database access.
Additionally, vulnerable targets can be identified using Google dorking techniques by searching for the vulnerable file path inurl:application/common/Model/Task.php.
What immediate steps should I take to mitigate this vulnerability?
There are no known vendor-provided countermeasures or patches for this vulnerability as the vendor did not respond to the disclosure.
Immediate mitigation steps include replacing the affected software (pearProjectApi versions up to 2.8.10) with an alternative product that is not vulnerable.
Until a fix is available, restricting access to the vulnerable endpoint and monitoring for suspicious activity related to SQL injection attempts is recommended.