CVE-2026-5666 Details
Description
A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the component SQL Database Backup File Handler. The manipulation results in insecure storage of sensitive information. The attack may be performed from remote. The exploit is now public and may be used.
A vulnerability in Code-Projects Online FIR System version 1.0 allows for sensitive information disclosure through an exposed SQL database backup file. The application improperly stores a database dump (complaints.sql) in a publicly accessible directory within the web root. This misconfiguration enables any unauthenticated user to download the file via HTTP, exposing the full database schema and application data, including user accounts, complaint records, and administrative information. The issue stems from inadequate server configuration and insecure storage practices, leaving sensitive data accessible to unauthorized users.
It is recommended to remove SQL files from the web root and store database backups in secure locations, such as restricted directories or internal storage systems, away from public access. Access to backup files should be limited to authorized administrators only. Additionally, disable directory listing, apply strict file permissions, and regularly audit exposed resources.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 6, 2026CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://code-projects.org/ | [email protected] | Vendor |
| https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Online%20FIR%20System%20PHP%20Exposed%20Database%20Backup.md | [email protected] | ExploitTechnical Description |
| https://vuldb.com/submit/786322 | [email protected] | Technical Description |
| https://vuldb.com/vuln/355489 | [email protected] | AdvisoryExploit |
| https://vuldb.com/vuln/355489/cti | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-922 | Insecure Storage of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| code-projects Online FIR System | 1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |