CVE-2026-7103 Details

A vulnerability exists in Code-Projects Chat System version 1.0, specifically in the user account update feature within the file update_user.php. This vulnerability combines Insecure Direct Object Reference (IDOR), SQL Injection, weak password hashing, and plaintext password storage. The IDOR aspect allows low-privilege users to overwrite any user's account details, including passwords, without authorization. The SQL Injection vulnerability arises from unsanitized user input being directly concatenated into SQL queries, creating two injection points. Additionally, a flaw in the password update logic can lead to passwords being stored in plaintext under certain conditions, while using MD5 hashing without salt, which is weak and easily reversible. This vulnerability can be exploited remotely by authenticated users with a valid session.

It is recommended to implement ownership validation, ensuring users can only update their own accounts. Using prepared statements to prevent SQL Injection, adopting strong password hashing methods, and removing the plaintext password storage fallback are also advised. Additionally, adding CSRF token validation, implementing role-based access control, and requiring current password confirmation for sensitive changes can enhance security.