CVE-2026-90846: PHPGurukul Expense Tracker SQL Injection

CVE-2026-90846 Overview

CVE-2026-90846 is a SQL injection vulnerability in PHPGurukul Daily Expense Tracker System 1.1. The flaw resides in the /dets/forgot-password.php script, where the email and contactno parameters are passed to the backend database without proper sanitization. Remote attackers can manipulate these arguments to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic exploitation against exposed instances. The weakness is categorized under CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Unauthenticated remote attackers can inject SQL through the password recovery form, potentially exposing user credentials and application data stored in the backend database.

Affected Products

PHPGurukul Daily Expense Tracker System 1.1
Deployments exposing /dets/forgot-password.php to untrusted networks
Downstream forks or customizations that reuse the vulnerable password recovery logic

Discovery Timeline

2026-09-15 - CVE-2026-90846 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90846

Vulnerability Analysis

The vulnerability exists in the forgot-password workflow of PHPGurukul Daily Expense Tracker System 1.1. The forgot-password.php handler accepts user-supplied email and contactno values and concatenates them into a SQL query used to look up the target account. Because the inputs are not parameterized or escaped, an attacker can break out of the query context and append arbitrary SQL clauses.

Exploitation requires no authentication and no user interaction. The attack surface is reachable over the network wherever the application is deployed, and the public disclosure of the technique lowers the barrier for opportunistic abuse. Successful injection can lead to database enumeration, credential disclosure, and unauthorized data modification within the scope of the database user.

Root Cause

The root cause is improper neutralization of special elements passed to the database interpreter, classified under CWE-74. The email and contactno parameters flow directly from the HTTP request into a dynamically constructed SQL statement. The application does not use prepared statements or input validation to constrain the accepted characters.

Attack Vector

An attacker sends a crafted POST request to /dets/forgot-password.php with malicious SQL payloads placed in the email or contactno fields. Because the response behavior of the password reset workflow varies with query success, both error-based and boolean-based techniques are viable. Additional details are documented in the GitHub CVE Issue Discussion and the VulDB CVE-2026-90846 Details entry.

Detection Methods for CVE-2026-90846

Indicators of Compromise

HTTP POST requests to /dets/forgot-packages.php (or /dets/forgot-password.php) containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( within the email or contactno parameters.
Database error messages surfaced in application logs originating from the forgot-password code path.
Unusual outbound query patterns or bulk row reads against user tables shortly after requests to the password recovery endpoint.

Detection Strategies

Deploy web application firewall rules that flag SQL injection payloads targeting forgot-password.php request parameters.
Correlate spikes in 500-level responses from the password recovery endpoint with source IP reputation data.
Enable database query logging and alert on syntactically unusual statements originating from the application service account.

Monitoring Recommendations

Monitor authentication and account-recovery endpoints for repeated failed submissions from a single IP or ASN.
Track database read volumes from the application account and alert on deviations from baseline.
Ingest web server access logs into a centralized analytics platform to enable retroactive hunting for injection patterns.

How to Mitigate CVE-2026-90846

Immediate Actions Required

Restrict network exposure of the Daily Expense Tracker System to trusted networks or place it behind an authenticated reverse proxy until a patch is available.
Deploy WAF signatures that block SQL injection attempts against /dets/forgot-password.php.
Audit the users and account-related tables for unauthorized reads, modifications, or credential dumps.

Patch Information

At the time of publication, PHPGurukul has not released a vendor advisory or fixed version referenced in the NVD entry. Monitor the PHP Gurukul Security Resources page for updates. Refer to the VulDB Vulnerability #403398 entry for tracking updates and mitigations.

Workarounds

Rewrite the forgot-password query to use prepared statements with bound parameters for email and contactno.
Apply strict server-side input validation, allowing only characters valid for email addresses and numeric contact values.
Disable or remove the password recovery endpoint if it is not required in the deployment.

bash

# Example WAF rule (ModSecurity) to block SQLi payloads on the vulnerable endpoint
SecRule REQUEST_URI "@streq /dets/forgot-password.php" \
    "phase:2,chain,deny,status:403,id:1009086,\
    msg:'Potential SQLi on Daily Expense Tracker forgot-password'"
    SecRule ARGS:email|ARGS:contactno "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|';|\bor\b\s+1=1)"