A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

A SQL injection vulnerability has been discovered in PHPGurukul Daily Expense Tracker System version 1.1. The vulnerability exists in the forgot-password.php file, where manipulation of the email and contactno arguments allows for SQL injection attacks. The flaw can be exploited remotely without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability affects an unknown function within the /dets/forgot-password.php endpoint. Attackers could potentially leverage this to extract, modify, or delete database contents. The issue has been reported and documented across multiple security databases including NVD and VulDB.