CVE-2026-14660: Online Job Portal 1.0 SQLi Vulnerability

CVE-2026-14660 Overview

CVE-2026-14660 is a SQL injection vulnerability in code-projects Online Job Portal 1.0. The flaw resides in an unspecified function within the login.php file. Attackers can manipulate the txtUser and txtPass parameters to inject arbitrary SQL statements into backend database queries. The vulnerability is remotely exploitable over the network and requires no authentication or user interaction. Public exploit details have been released, increasing the likelihood of opportunistic exploitation against exposed deployments. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL through the login form parameters txtUser and txtPass, potentially bypassing authentication and reading or modifying database contents.

Affected Products

code-projects Online Job Portal 1.0
Deployments exposing the vulnerable login.php endpoint
Applications built on the same login handler code base

Discovery Timeline

2026-07-04 - CVE-2026-14660 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14660

Vulnerability Analysis

The vulnerability affects the authentication handler in login.php of code-projects Online Job Portal 1.0. User-supplied values from the txtUser and txtPass HTTP request parameters are concatenated directly into a SQL statement without parameterization or input sanitization. This allows an attacker to break out of the intended string literal context and append attacker-controlled SQL syntax to the query.

Because the vulnerable endpoint is the login form itself, no valid credentials or session are required. Attackers can craft payloads that make the authentication predicate evaluate to true, bypassing the login check. The same injection point supports UNION-based and boolean-based extraction techniques for exfiltrating credentials, job seeker records, and administrative account data.

Exploit details are publicly documented in the referenced GitHub CVE Analysis and cataloged on VulDB CVE-2026-14660. The EPSS score is 0.412% as of 2026-07-09.

Root Cause

The root cause is direct string concatenation of untrusted request parameters into a SQL query. The application does not use prepared statements, parameterized queries, or an ORM abstraction. It also lacks input validation and escaping for characters such as single quotes, semicolons, and SQL comment sequences.

Attack Vector

Exploitation is performed remotely over HTTP by submitting a crafted POST request to login.php. An attacker supplies malicious SQL fragments in the txtUser or txtPass fields. Classic payloads include tautologies that force the WHERE clause to return a valid row, or UNION SELECT clauses that pivot the result set to arbitrary tables. No authentication, privileges, or user interaction are required to initiate the attack.

See the VulDB Vulnerability #376174 entry for additional exploitation context.

Detection Methods for CVE-2026-14660

Indicators of Compromise

HTTP POST requests to login.php containing SQL metacharacters such as ', --, #, /*, or ; in the txtUser or txtPass parameters
Login requests containing keywords like UNION, SELECT, OR 1=1, SLEEP(, or BENCHMARK( in credential fields
Anomalous successful authentications from unfamiliar IP addresses without prior account activity
Elevated database error responses or unexpected 500-series HTTP responses from the login endpoint

Detection Strategies

Deploy web application firewall (WAF) rules that inspect login.php POST bodies for SQL injection signatures targeting txtUser and txtPass
Enable verbose web server and database query logging, then alert on syntactically malformed SQL originating from the login handler
Correlate failed login bursts followed by a single successful authentication with unusual payload lengths in credential fields

Monitoring Recommendations

Monitor authentication logs for requests whose parameter values exceed expected username or password length
Track outbound data volume from the database host to detect bulk record exfiltration following suspicious login activity
Alert on any use of SQL comment tokens or boolean expressions inside HTTP form parameters submitted to authentication endpoints

How to Mitigate CVE-2026-14660

Immediate Actions Required

Restrict public network exposure of the Online Job Portal 1.0 login page until a fix is applied
Place the application behind a WAF configured with SQL injection rulesets that inspect txtUser and txtPass
Rotate all database credentials and administrative account passwords if exploitation is suspected
Review database audit logs for unauthorized SELECT, UPDATE, or DROP activity originating from the web application account

Patch Information

No official vendor patch has been published for code-projects Online Job Portal 1.0 at the time of NVD publication. Operators should refactor login.php to use parameterized queries or prepared statements and apply server-side input validation to authentication parameters. Consult the Code Projects Resource Hub for any subsequent vendor updates.

Workarounds

Rewrite the login query using prepared statements with bound parameters, for example mysqli_prepare or PDO with bindParam
Enforce strict allowlist validation on the txtUser field to reject non-alphanumeric characters
Apply least-privilege permissions to the database account used by the web application to limit the impact of successful injection
Deploy a virtual patch through a reverse proxy or WAF that blocks known SQL injection payload patterns targeting the login endpoint

bash

# Example ModSecurity rule blocking SQL metacharacters on login.php
SecRule REQUEST_URI "@endsWith /login.php" \
    "phase:2,chain,deny,status:403,id:1026146600,\
    msg:'Potential SQLi on Online Job Portal login (CVE-2026-14660)'"
  SecRule ARGS:txtUser|ARGS:txtPass "@rx (?i)(\'|--|#|/\*|\bunion\b|\bselect\b|\bor\b\s+\d+=\d+)" \
    "t:none,t:urlDecodeUni"