CVE-2026-6490: QueryMine SMS SQL Injection Vulnerability

CVE-2026-6490 Overview

A SQL Injection vulnerability has been identified in the QueryMine SMS application, affecting the admin/deletecourse.php file within the GET Request Parameter Handler component. The vulnerability allows remote attackers to manipulate the ID parameter to inject malicious SQL commands, potentially leading to unauthorized database access, data manipulation, or extraction of sensitive information.

Critical Impact

Remote attackers can exploit this SQL Injection vulnerability without authentication to compromise database integrity and confidentiality through malicious GET request parameters.

Affected Products

• QueryMine SMS (up to commit 7ab5a9ea196209611134525ffc18de25c57d9593)

Discovery Timeline

• 2026-04-17 - CVE-2026-6490 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6490

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), specifically manifesting as a SQL Injection flaw. The vulnerable endpoint admin/deletecourse.php fails to properly sanitize the ID parameter received through GET requests before incorporating it into SQL queries.

The attack can be initiated remotely without requiring authentication, making it particularly dangerous for exposed instances. An exploit has been publicly disclosed, increasing the risk of active exploitation. The vendor was notified about this vulnerability but did not respond, leaving users without an official remediation path.

QueryMine SMS uses a rolling release model for continuous updates, which means specific version identifiers for affected or patched releases are not available. Users must verify their deployment against the vulnerable commit hash.

Root Cause

The root cause of this vulnerability is insufficient input validation and lack of parameterized queries in the admin/deletecourse.php file. The ID parameter from GET requests is directly concatenated into SQL statements without proper sanitization or the use of prepared statements, enabling injection attacks.

Attack Vector

The attack vector is network-based, requiring no user interaction or prior authentication. An attacker can craft malicious GET requests targeting the admin/deletecourse.php endpoint with a manipulated ID parameter containing SQL injection payloads.

The vulnerability allows attackers to inject arbitrary SQL commands by manipulating the ID parameter in GET requests to the admin/deletecourse.php endpoint. When the unsanitized parameter value is incorporated into database queries, the injected SQL code executes within the database context. This could enable attackers to extract sensitive data, modify or delete records, or potentially escalate to more severe compromises depending on database permissions. Technical details are available in the GitHub Deployment Document.

Detection Methods for CVE-2026-6490

Indicators of Compromise

• Unusual GET requests to admin/deletecourse.php containing SQL syntax characters such as single quotes, double dashes, or UNION statements in the ID parameter
• Database error messages exposed in HTTP responses indicating failed injection attempts
• Unexpected database queries or access patterns originating from web application processes
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in request parameters
• Enable detailed logging for all requests to administrative endpoints, particularly those handling database operations
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection attack patterns
• Monitor database query logs for anomalous queries or syntax errors

Monitoring Recommendations

• Configure alerts for repeated requests to admin/deletecourse.php with malformed or suspicious ID values
• Establish baseline access patterns for administrative functions and alert on deviations
• Monitor database audit logs for unauthorized SELECT, UPDATE, or DELETE operations

How to Mitigate CVE-2026-6490

Immediate Actions Required

• Restrict network access to the QueryMine SMS administrative interface to trusted IP addresses only
• Place the application behind a Web Application Firewall with SQL injection protection enabled
• If possible, disable or remove the admin/deletecourse.php endpoint until a fix is available
• Audit database logs for evidence of prior exploitation attempts

Patch Information

No official patch has been released by the vendor. The vendor was contacted about this disclosure but did not respond. Organizations should monitor the VulDB entry and the project repository for any future updates or community-contributed fixes.

Workarounds

• Implement input validation at the application or reverse proxy level to reject non-numeric values in the ID parameter
• Deploy a WAF rule to sanitize or block requests containing SQL metacharacters in GET parameters
• Restrict access to administrative endpoints through network segmentation or authentication controls
• Consider migrating to an alternative SMS management solution with better security maintenance

# Example: Restrict access to admin directory using Apache .htaccess
# Place this in the admin/.htaccess file
<Files "deletecourse.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Files>