CVE-2026-90844: PHPGurukul Expense Tracker SQL Injection

CVE-2026-90844 Overview

CVE-2026-90844 is a SQL injection vulnerability affecting PHPGurukul Daily Expense Tracker System version 1.1. The flaw resides in the login component at /dets/index.php, where the email parameter is passed directly to a backend SQL query without proper sanitization. Remote attackers can exploit this issue over the network without authentication or user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic scanning and abuse. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can manipulate the email parameter on the login page to inject arbitrary SQL, potentially bypassing authentication and exposing stored data.

Affected Products

PHPGurukul Daily Expense Tracker System 1.1
Component: Login (/dets/index.php)
Parameter: email

Discovery Timeline

2026-09-15 - CVE-2026-90844 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90844

Vulnerability Analysis

The vulnerability exists in the login handler at /dets/index.php in PHPGurukul Daily Expense Tracker System 1.1. The application accepts an email value from the login form and concatenates it directly into a SQL statement used to validate credentials. Because the input is not parameterized or escaped, an attacker can inject SQL syntax that alters the query's logic.

Successful injection can allow the attacker to bypass authentication, enumerate database contents, or read sensitive records such as user credentials and expense entries. The attack requires no prior authentication, and exploit details are publicly available. Because the login endpoint is exposed over HTTP, attackers can automate exploitation at scale using standard tooling.

Root Cause

The root cause is improper neutralization of user-supplied input before use in a SQL query [CWE-74]. The email parameter is embedded into the query string without prepared statements or input validation, allowing attacker-controlled fragments to change query semantics.

Attack Vector

Exploitation proceeds over the network against the public login page. An attacker submits a crafted email value containing SQL metacharacters through a normal HTTP POST request to /dets/index.php. No credentials, tokens, or user interaction are required. See the GitHub CVE Issue Discussion and the VulDB CVE-2026-90844 entry for public technical context.

No verified proof-of-concept code is reproduced here. Technical details are available through the referenced advisories.

Detection Methods for CVE-2026-90844

Indicators of Compromise

HTTP POST requests to /dets/index.php containing SQL metacharacters in the email field, including single quotes, --, UNION SELECT, OR 1=1, or SLEEP(.
Web server or application logs showing malformed email values, unusually long inputs, or encoded payloads targeting the login form.
Database error messages returned to clients or written to logs during login attempts.
Anomalous authentication successes originating from unfamiliar source addresses following manipulation of login parameters.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL injection patterns targeting the /dets/index.php endpoint and the email parameter.
Enable database query logging and alert on unexpected UNION, SLEEP, BENCHMARK, or comment sequences in queries originating from the login flow.
Correlate repeated failed logins followed by an unexplained success from the same source address as a likely injection attempt.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation of login abuse.
Baseline normal login request patterns and alert on payload length or character-class deviations in the email field.
Monitor outbound connections from the web server for signs of post-exploitation data exfiltration.

How to Mitigate CVE-2026-90844

Immediate Actions Required

Restrict network exposure of the Daily Expense Tracker System login page to trusted networks or place it behind a VPN until a fix is applied.
Deploy WAF signatures that block SQL injection payloads targeting the email parameter on /dets/index.php.
Review web server and database logs for prior exploitation attempts and rotate any credentials that may have been exposed.
Audit user accounts for unauthorized additions or privilege changes.

Patch Information

No vendor patch has been referenced in the NVD entry at the time of publication. Monitor the PHP Gurukul Home site for updated releases and consult the VulDB Vulnerability #403396 entry for ongoing status. Until an official fix is available, apply the compensating controls listed below.

Workarounds

Modify the login handler in /dets/index.php to use parameterized queries or prepared statements for all user-supplied input.
Apply strict server-side input validation on the email field, rejecting values that do not match a standard email format.
Enforce least-privilege database accounts for the application so injection cannot escalate to administrative database operations.
Enable generic error handling to prevent database error messages from being returned to clients.

bash

# Configuration example: ModSecurity rule to block SQLi patterns on the login endpoint
SecRule REQUEST_URI "@streq /dets/index.php" \
  "id:1009001,phase:2,deny,status:403,log,msg:'Possible SQLi on DETS login',\
  chain"
  SecRule ARGS:email "@rx (?i)(union(\s|\+)+select|or\s+1=1|sleep\(|--|;)" \
    "t:none,t:urlDecodeUni"