CVE-2026-71207

CVE-2026-71207 is a PHP login.php with two independent authentication bypasses living in the same file. First, a classic SQL injection: raw $_POST values flow through $_SESSION into a concatenated query with zero parameterization. Second, a hardcoded admin/neola credential check embedded directly in the authentication logic. These aren't variations of the same mistake—they represent fundamentally different failure modes, and their coexistence tells you this codebase shipped without any security gatekeeping at any stage of development. The immediate operational concern: these two paths form a compound exploit chain. The SQLi lets attackers dump the application and discover the hardcoded credential embedded in the code. Once they have admin/neola, they have persistent access that produces zero anomalous traffic, leaves no SQLi payload signatures, and is indistinguishable from legitimate authentication. Defenders building detection rules for SQL injection payloads will miss the credential-based re-entry entirely—that's a detection blind spot baked into how most SIEM rules are written. Beyond the specific flaws, treat this as a signal about the broader codebase. The $_POST → $_SESSION → concatenation pattern is a recognizable inheritance marker from PHP tutorial repositories circa 2012-2017. When you find this configuration in one file, assume other files in the same application inherited from the same insecure source tree. One-off vulnerabilities in niche internal tools are rare; tutorial-era inheritance patterns are not. The CVSS 9.8 paired with EPSS 0.00701 (roughly 30th percentile) creates a prioritization puzzle. The EPSS reflects population-level exploit probability—it tells you this specific application won't attract mass scanning or dedicated exploit development. But ignore the EPSS for your own instances. If this application holds employee PII, connects to financial systems, or sits on your internal network with any attacker who already has internal access, the EPSS is meaningless. The credential path requires nothing more than a login form and valid-looking credentials. For an attacker with internal network access, the time from discovery to authenticated persistence drops from minutes (SQLi) to seconds (credential stuffing). The low EPSS doesn't shrink your blast radius. Prioritize remediation based on asset criticality and network exposure, not the severity score alone. The SQLi is straightforward to fix with parameterized queries. The hardcoded credential requires touching the authentication flow—coordinate with the business unit, plan for potential password resets, and test thoroughly. Treat this as a single vulnerability in one file but a warning sign for the entire application.

Reviewed through automated stages and approved by a human before publication.