CVE-2026-104625: CodeAstro Simple Loan Management System index.php sql injection
A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs remote network access and low-privileged access to the application, as indicated by the PR:L vector. No user interaction is required.
Which component and input should be investigated?
Investigate the administrative endpoint at /admin/index.php and its g_name argument. The reported issue is SQL injection in an otherwise unspecified function of that file.
How urgent is remediation?
The vulnerability is rated medium severity at CVSS 6.3, with low impact to confidentiality, integrity, and availability. However, public exploit availability is reported, which increases the likelihood of attempted exploitation.