CVE-2026-112142: SQL Injection in satya-vinay Events-Management-System

A SQL injection vulnerability exists in the satya-vinay Events-Management-System up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. The flaw is in the Registration-Delete Handler's dodelete.php file, where manipulation of the ID parameter leads to SQL injection. The vulnerability can be exploited remotely without authentication. The project follows a rolling release model, so no discrete version numbers are provided for affected or patched releases. The vendor has been notified but has not issued a patch or response. Public exploit code is available, though no confirmed exploitation in the wild is reported.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection via the ID parameter in the Registration-Delete Handler, potentially leading to unauthorized data access or manipulation. The CVSS score of 6.9 reflects a medium severity impact with low attack complexity and no privileges or user interaction required. The vulnerability could compromise the integrity and confidentiality of the backend database.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is provided, restricting access to the vulnerable component or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in dodelete.php may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.