CVE-2026-9584: code-projects Project Management System Login chk.php sql injection
A security vulnerability has been detected in code-projects Project Management System 1.0. Affected is an unknown function of the file chk.php of the component Login. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
code-projects Project Management System Login chk.phpfrom your environment.If feasible, remove, rename, or disable chk.php (the Login component) to prevent remote exploitation until a proper fix is obtained.
- Configuration
Configure the web server or application access controls to block or restrict HTTP access to chk.php (the Login check handler) until a vendor-provided patch is available.
Web server / application access control access to chk.php = deny or restrict to trusted IPs - Compensating control
Deploy WAF/IPS rules or firewall ACLs to detect and block SQL injection attempts targeting chk.php and restrict access to login endpoints to trusted IP ranges; apply rate limiting and request inspection for the login path.
- Operational
Because the exploit has been publicly disclosed and may be used, review web and database logs for signs of SQL injection or other suspicious activity and, if compromise is suspected, rotate database and application credentials and investigate for unauthorized access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9584?
CVE-2026-9584 has a high severity rating of 7.3.
What type of vulnerability is CVE-2026-9584?
CVE-2026-9584 is an SQL injection vulnerability in the chk.php file of the Code-projects Project Management System.
How do I fix CVE-2026-9584?
To fix CVE-2026-9584, it is recommended to update the Code-Projects Project Management System to the latest version that addresses this SQL injection issue.
Can CVE-2026-9584 be exploited remotely?
Yes, CVE-2026-9584 is vulnerable to remote exploitation due to SQL injection.
What component is affected by CVE-2026-9584?
CVE-2026-9584 affects the Login component in the chk.php file of Code-projects Project Management System.