This vulnerability in PHPGurukul Daily Expense Tracker System 1.1 allows an attacker to perform SQL injection via the email/contactno parameter in the /dets/forgot-password.php script. The injection occurs due to insufficient input validation, enabling remote exploitation without authentication. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. The exploit has been publicly disclosed, increasing the risk of potential attacks.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. No evidence of active exploitation in the wild is currently known.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection on the affected parameter.