CVE-2026-4970 Details
Description
A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file delete_photos.php of the component Endpoint. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
A SQL injection vulnerability has been identified in Code-Projects Social Networking Site version 1.0, specifically within the delete_photos.php file of the Endpoint component. The issue arises because the application improperly validates and sanitizes user input from the id parameter before incorporating it into SQL queries. This vulnerability can be exploited remotely, allowing attackers to execute arbitrary SQL commands through crafted HTTP requests.
It is recommended to use prepared statements for SQL queries, validate input to ensure only numeric values are accepted, and implement authorization checks to ensure users can only delete their own photos. Additionally, destructive actions should be performed using POST requests with CSRF protection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 27, 2026CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://code-projects.org/ | [email protected] | Not ApplicableVendor |
| https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20in%20Social%20Networking%20Site%20v1.0%20delete_photos.php.md | [email protected] | ExploitRemedyTechnical Description |
| https://vuldb.com/?ctiid.353857 | [email protected] | Content Wall |
| https://vuldb.com/?id.353857 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.777870 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Code-Projects Social Networking Site | 1.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |