CVE-2026-114256: SQL Injection in oretnom23 file-management-system-php

This vulnerability in oretnom23 file-management-system-php up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 affects multiple functions in the Folder Management component's admin_class.php file. Improper sanitization or validation of input parameters (name, parent_id, id, type, folder_id, description) allows remote attackers to perform SQL injection. The vulnerability is exploitable remotely without authentication and has a CVSS 4.0 score of 6.9. The project has not provided a patch or official fix yet, and the rolling release model prevents clear version identification. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate the backend database remotely, potentially leading to unauthorized data access, modification, or deletion. The vulnerability does not require authentication and has low attack complexity, increasing its risk. However, the CVSS vector indicates low confidentiality, integrity, and availability impacts, suggesting limited but significant impact.

No official fix or patch has been released by the vendor as of now. Since the project has not responded to the issue report, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected functions or deploying web application firewalls (WAFs) that can detect and block SQL injection attempts targeting the specified parameters. Avoid exposing the vulnerable component to untrusted networks if possible.