🚨 CVE-2026-42569 - phpVMS Unauth Database Wipe

Unauthenticated Database Wipe / Destructive Import in phpVMS

📌 Overview

CVE-2026-42569 is a critical vulnerability in phpVMS (Virtual Airline Management System) that allows unauthenticated attackers to access legacy import endpoints.

These endpoints were supposed to be restricted but remain accessible in versions ≤ 7.0.5, potentially allowing attackers to trigger mass deletion or database wipe operations.

🛠 Affected Versions

⚠️ Impact

• Unauthenticated access
• Mass deletion of flights, users, schedules, and other critical data
• Possible full database wipe (TRUNCATE / DELETE operations)
• Complete compromise of the virtual airline system

🧪 PoC Usage

python3 CVE-2026-42569.py http://target.com

Example Output (Success):

[+] SUCCESS! Endpoint reachable: /importer
[!!] Target is VULNERABLE to CVE-2026-42569
[!!] Database wipe / mass deletion is possible!

🛡️ Mitigation

1. Update immediately to phpVMS 7.0.6 or newer.
2. Remove or restrict access to /importer and /import endpoints.
3. Block access to legacy import routes in your web server (Nginx/Apache).
4. Regularly backup your database.

🔧 Quick Temporary Fix (Nginx)

location ~* ^/(importer|import) {
    deny all;
    return 403;
}

⚠️ Disclaimer

This repository is for educational and authorized security testing only.
The author is not responsible for any misuse or damage caused by this tool.
Unauthorized exploitation is illegal.