A security flaw exists in the pearProjectApi back‑end component. The dateTotalForProject function in Task.php accepts a projectCode parameter without proper sanitization, enabling an attacker to inject arbitrary SQL statements. This flaw aligns with CWE‑74 (SQL Injection) and CWE‑89 (Improper neutralization of special elements in an SQL command). If exploited, the attacker can read, modify, or delete data within the database, compromising confidentiality and integrity.

The vulnerability affects the pearProjectApi product, version 2.8.10 and earlier. No later versions are disclosed as patched. Users running any supported release prior to 2.8.10 are at risk.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score of less than 1% suggests that automated exploitation is currently rare, yet public exploit code has been released, making manual attacks feasible. The vulnerability is not listed in the CISA KEV catalog, but the existence of public exploits increases the potential for targeted attacks. Attackers can trigger the flaw remotely by sending a crafted request containing a malicious projectCode value, which the unprotected SQL statement then executes on the server.