Description
A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-08-21
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness exists in the saveUser function of the SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP. The function accepts a parameter called Researcher without proper sanitization, allowing an attacker to inject arbitrary SQL. Depending on database privileges, this can lead to unauthorized data disclosure, modification, or deletion. The injection is made possible through the public web interface.

Affected Systems

SourceCodester’s Dynamic Input Field Generator Using HTML, CSS, and PHP, version 1.0. This product is available at sourcecodester.com and includes the vulnerable file /public/submit.php. No other versions or vendors are listed.

Risk and Exploitability

The CVSS base score of 5.3 indicates a medium severity. No EPSS rating is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote; publicly available exploit code can be used by attackers to submit crafted requests to the Researcher argument, potentially gaining access to or altering the underlying database. The problems are classified as CWE‑74 and CWE‑89.

Generated by OpenCVE AI on August 21, 2026 at 03:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor‑supplied update or patch that replaces the vulnerable saveUser logic with parameterized queries or other proper input handling. In the absence of an official patch, modify the code to use prepared statements to bind all user-supplied values.
  • Sanitize and validate all user input, especially the Researcher parameter, using strict whitelisting or escaping before inclusion in any SQL statement.
  • Limit the database account privileges that the application uses to only the minimum required for functional operations, preventing administrative actions such as dropping tables or bypassing authentication.
  • Configure logging and monitoring to detect anomalous SQL queries or repeated injection attempts, and block offending IP addresses or accounts when suspicious activity is observed.

Generated by OpenCVE AI on August 21, 2026 at 03:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection
First Time appeared Sourcecodester
Sourcecodester dynamic Input Field Generator Using Html Css And Php
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:dynamic_input_field_generator_using_html_css_and_php:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester dynamic Input Field Generator Using Html Css And Php
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Dynamic Input Field Generator Using Html Css And Php
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-21T01:45:11.812Z

Reserved: 2026-08-20T19:38:13.831Z

Link: CVE-2026-77392

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-21T02:16:28.063

Modified: 2026-08-21T02:16:28.063

Link: CVE-2026-77392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T04:00:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')