Description
A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
Published: 2026-08-07
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An injection flaw in the email field of the ajax.php?action=login endpoint allows attackers to execute arbitrary SQL queries. The flaw enables the attacker to read, modify, or delete any data stored in the database, potentially exposing sensitive information or compromising data integrity. If the database user has elevated privileges, the attacker could further gain unauthorized access to the system.

Affected Systems

SourceCodester Photo Share Website, version 1.0, provided by SourceCodester.

Risk and Exploitability

The vulnerability can be exploited remotely through a crafted HTTP request; based on the description, it is inferred that authentication is not required. The exploit has been publicly disclosed, which may increase the likelihood of attacks. The CVSS score of 6.9 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely targeted.

Generated by OpenCVE AI on August 7, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Sanitize user input by employing parameterized queries or stored procedures to eliminate the possibility of arbitrary SQL execution.
  • Limit the database account privileges used by the application to only the operations required for the website's normal function.
  • Apply any vendor‑supplied patch or update as soon as it becomes available.
  • If no patch is available, deploy a web application firewall rule that blocks suspicious payload patterns targeting the email parameter.

Generated by OpenCVE AI on August 7, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
Title SourceCodester Photo Share Website ajax.php login sql injection
First Time appeared Sourcecodester
Sourcecodester photo Share Website
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester photo Share Website
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Photo Share Website
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-07T18:06:51.064Z

Reserved: 2026-08-06T20:11:34.118Z

Link: CVE-2026-19196

cve-icon Vulnrichment

Updated: 2026-08-07T18:06:48.185Z

cve-icon NVD

Status : Deferred

Published: 2026-08-07T06:16:56.737

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-19196

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T09:58:24Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')