CVE-2026-41462: ProjeQtor Unauthenticated SQL Injection in Login Endpoint Affects Versions 7.0 Through 12.4.3 (CVSS 9.8)

Executive Summary

CVE-2026-41462 is a critical unauthenticated SQL injection vulnerability affecting ProjeQtor, a widely used open-source project management platform. The flaw exists in the login functionality: the login variable (username field) is directly concatenated into a SQL query without parameterization or sanitization, allowing an attacker to inject arbitrary SQL expressions.

With a CVSS score of 9.8, the vulnerability requires no prior authentication and can be exploited remotely with minimal effort. All ProjeQtor instances running versions 7.0 through 12.4.3 are affected. Organizations using ProjeQtor should apply the vendor patch immediately or implement interim mitigations.

Vulnerability Overview

Affected Versions

Technical Analysis

What Is ProjeQtor?

ProjeQtor is a free, open-source project management tool offering task tracking, Gantt charts, resource management, time tracking, and reporting. It is used by small businesses, enterprises, and public sector organizations, and can be self-hosted — making the attack surface especially broad.

The Vulnerability

The login form submits a username value to the server-side authentication logic. The server code directly appends this value to a SQL query string without using parameterized queries or prepared statements:

Vulnerable pattern (conceptual):
  query = "SELECT * FROM users WHERE login = '" + username_input + "'"

An attacker supplying a crafted username value can break out of the string literal and inject arbitrary SQL. This class of vulnerability (CWE-89) is one of the most well-documented and exploitable flaws in web applications.

SQL Injection Capabilities

Through this vulnerability, an attacker can:

Attack Flow

1. Attacker accesses the ProjeQtor login page (no authentication required)
2. Attacker submits a crafted username containing SQL metacharacters
3. The unsanitized input is interpolated directly into the SQL query
4. The SQL engine executes the injected statement with database user privileges
5. Attacker achieves authentication bypass and/or full database access

Impact Assessment

Remediation

Step 1: Upgrade ProjeQtor

Check the ProjeQtor releases page for a patched version (12.4.4 or later) and upgrade immediately.

# Back up current installation and database first
mysqldump -u <user> -p projeqtor > projeqtor_backup.sql
 
# Download and apply the patched release following ProjeQtor's upgrade guide

Step 2: Restrict Access to the Login Page

If an immediate upgrade is not possible, limit access to the ProjeQtor web interface via network controls:

# Nginx — restrict access to internal IP ranges
location / {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}

Step 3: Enable a Web Application Firewall (WAF)

A WAF with SQL injection detection rules can block exploitation attempts while a patch is being applied:

# ModSecurity with OWASP Core Rule Set (CRS) provides SQLi detection
# Enable CRS rule set in your web server's ModSecurity configuration

Step 4: Audit for Prior Exploitation

Check your database and application logs for signs of injection attempts:

# Review web server access logs for suspicious login requests
grep -i "login" /var/log/nginx/access.log | grep -E "('|--|;|UNION|SELECT)" 
 
# Check for unexpected admin accounts in the database
mysql -u <user> -p projeqtor -e "SELECT * FROM t_user WHERE is_admin = 1;"

Detection Indicators

Post-Remediation Checklist

1. Upgrade to a patched ProjeQtor release
2. Rotate all ProjeQtor user passwords — assume credentials may have been exfiltrated
3. Audit application and database logs for injection attempts during the exposure window
4. Review all admin accounts for unauthorized additions
5. Restrict ProjeQtor network access to authorized IP ranges
6. Enable WAF rules for SQLi detection going forward
7. Assess whether any personal data was involved and determine regulatory notification obligations

References

• NVD — CVE-2026-41462
• ProjeQtor Official Website
• CWE-89 — SQL Injection
• OWASP SQL Injection Prevention Cheat Sheet