CVE-2026-90841: PHPGurukul Blood Donor System SQL Injection

CVE-2026-90841 Overview

CVE-2026-90841 is a SQL injection vulnerability in PHPGurukul Blood Donor Management System 1.0. The flaw resides in the /application/controllers/admin/Report.php file, which handles the Report Endpoint component. Attackers can manipulate the fromdate and todate parameters to inject arbitrary SQL statements. The attack is remotely exploitable and requires no authentication or user interaction. Public exploit details have been released, increasing the risk of opportunistic attacks against exposed installations. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Remote unauthenticated attackers can execute arbitrary SQL queries against the backend database, exposing donor records and administrative data.

Affected Products

• PHPGurukul Blood Donor Management System 1.0
• Report Endpoint component (/application/controllers/admin/Report.php)
• Deployments exposing the admin report functionality to untrusted networks

Discovery Timeline

• 2026-09-15 - CVE-2026-90841 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90841

Vulnerability Analysis

The vulnerability exists in the report generation logic of PHPGurukul Blood Donor Management System 1.0. The Report.php controller accepts fromdate and todate parameters from HTTP requests and concatenates them directly into SQL queries without sanitization or parameter binding. This flaw allows attackers to alter query structure, extract data, or bypass authorization checks. The exploit vector is remote and requires no privileges, making the Report Endpoint reachable by any network-connected adversary.

Root Cause

The root cause is improper neutralization of user-controlled input embedded into SQL statements. The application fails to apply prepared statements or input validation on the fromdate and todate arguments before passing them to the database driver. This maps to CWE-74, a broader injection weakness class where downstream interpreters treat attacker data as code.

Attack Vector

An attacker sends a crafted HTTP request to the admin report endpoint with malicious payloads in the fromdate or todate fields. The injected SQL syntax alters the query executed by the backend, enabling data exfiltration, boolean-based inference, or time-based blind extraction. Because no authentication is required and the attack is network-based, exploitation can be automated against internet-exposed instances. Public disclosure of exploit details, referenced through the VulDB Vulnerability Details and GitHub Issue Discussion, lowers the barrier for adversaries.

No verified proof-of-concept code is available in the enriched data. Refer to the linked advisories for technical exploitation details.

Detection Methods for CVE-2026-90841

Indicators of Compromise

• HTTP requests to /application/controllers/admin/Report.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in fromdate or todate parameters.
• Web server access logs showing repeated report queries from a single source with unusual date-parameter values or encoded payloads.
• Database error strings in application logs referencing MySQL syntax failures tied to report generation.

Detection Strategies

• Deploy web application firewall rules targeting SQL injection patterns in fromdate and todate query-string arguments.
• Enable database query logging and alert on report queries containing tautologies, stacked queries, or INFORMATION_SCHEMA references.
• Correlate anomalous outbound data volumes with admin report endpoint activity to detect exfiltration.

Monitoring Recommendations

• Monitor the admin report endpoint for unauthenticated access attempts and anomalous request frequency.
• Baseline normal date-range parameter formats and alert on deviations that include SQL operators or encoded characters.
• Track failed database queries originating from the PHPGurukul application to surface probing activity.

How to Mitigate CVE-2026-90841

Immediate Actions Required

• Restrict access to the /admin/ path using network ACLs, VPN, or IP allowlists until a patch is applied.
• Deploy a WAF rule blocking SQL metacharacters in the fromdate and todate parameters of report requests.
• Review database and web server logs for prior exploitation attempts using indicators listed above.
• Rotate database credentials if evidence of unauthorized query execution is found.

Patch Information

No vendor patch is referenced in the enriched CVE data. Monitor the PHP Gurukul Security Resource and the VulDB CVE Report for updated fix information. Until an official update is released, apply compensating controls and consider replacing the vulnerable component in production environments.

Workarounds

• Modify Report.php to use prepared statements with parameter binding for all date inputs.
• Enforce strict server-side input validation, accepting only ISO date formats for fromdate and todate.
• Apply the principle of least privilege to the database user account used by the application, limiting it to SELECT on required tables only.
• Disable or firewall the admin report endpoint if it is not actively required for business operations.