CVE-2026-1160: SQL Injection in PHPGurukul Directory Management System

CVE-2026-1160 is a high-severity SQL injection (CVSS 7.3) in PHPGurukul Directory Management System 1.0. Changing the searchdata argument of /index.php lets a remote attacker alter the database query, with no login required by the CVSS vector. No fixed version is listed in the record, so limit who can reach the application and check with the vendor.

What's affected

• Product: PHPGurukul Directory Management System 1.0.
• Vulnerable file: /index.php, component: Search.
• Vulnerable argument: searchdata.
• Fixed version: none listed. The record does not mention a vendor response.
• Weakness classes: CWE-74 (injection) and CWE-89 (SQL injection).
• Published: 19 January 2026. The CVSS vector shows network access, low complexity, no privileges and no user interaction.
• Exploitation: the record says an exploit has been publicly disclosed. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is being exploited in the wild.

How to check if you're exposed

This is a web application, so a dependency scan will not find it. The check is about where it runs and who can reach it.

1. Check whether anyone in your organization deployed PHPGurukul Directory Management System 1.0, including on test servers and shared hosting accounts that never made it into an inventory.
2. From outside your network, see whether the host answers on /index.php. A plain request with no parameters is enough.
3. Search web server and proxy logs for that path and look for odd searchdata values, such as quotes, SQL keywords or very long strings.

grep -F "/index.php" /var/log/nginx/access.log

What to do now

1. Take /index.php off the public internet, or restrict the whole application to a VPN. A deny rule at the reverse proxy is a reasonable stopgap if you confirm the rest of the application still works.
2. Review historical logs for the path and the searchdata argument. If you find suspicious requests, treat the database contents and the application database credentials as exposed and rotate the credentials.
3. Ask the vendor for a fixed build and watch the Gold entry for CVE-2026-1160 for updates. Do not assume a fix exists until the vendor says so.
4. If you maintain a copy of the code, change the query behind searchdata to use prepared statements with bound parameters, and validate the value against the type you expect.

Why it matters

SQL injection happens when text from a request is placed straight into a database query, so the database treats part of the input as instructions. The searchdata argument is read from the HTTP request and reaches a query without being kept separate from the query text. The record does not publish the query itself, and neither do we.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold entry and CVE record: CVE-2026-1160, published 19 January 2026.
• References listed in the record, not retrievable for this review: VulDB entry and the researcher issue.

Last reviewed: 19 October 2026.