CVE-2026-77392: SQL Injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP

This vulnerability exists in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP version 1.0, specifically in the saveUser function of /public/submit.php. An attacker can remotely exploit the SQL injection flaw by manipulating the 'Researcher' parameter, potentially allowing unauthorized database queries. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor advisory or patch information is provided, and the exploit code has been publicly released.

Successful exploitation could allow an attacker with low privileges to perform SQL injection attacks remotely, potentially leading to unauthorized data access or modification with limited impact scope as indicated by the CVSS vector. The vulnerability does not require user interaction and has partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or parameterized queries as a temporary mitigation to prevent SQL injection on the affected parameter.