EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting malicious code through the firstname parameter. By sending specially crafted POST requests to the insert.php endpoint, an attacker can alter SQL statements and potentially extract or modify sensitive database information. This vulnerability is categorized as CWE-89, reflecting a flaw in unvalidated input handling that leads to code execution within the database context, compromising confidentiality.

The affected product is EgavilanMedia PHPCRUD 1.0, distributed by Egavilanmedia. No additional version details are provided beyond the 1.0 release. The vulnerability applies to installations that expose the insert.php endpoint and accept unfiltered firstname input.

The CVSS base score for this issue is 8.8, indicating high severity. Because the flaw does not require authentication and can be triggered via simple HTTP POST, the risk of exploitation is high. The EPSS score is not available, but the lack of a KEV listing does not diminish the need for immediate mitigation. An attacker can easily craft POST payloads and gain unauthorized access to database contents. The attack vector is external, over the network, exploiting the web application.