SQL Injection Flaw in QueryMine SMS: Remote Exploitation Possible

The National Vulnerability Database has disclosed CVE-2026-6490, a critical SQL injection vulnerability affecting QueryMine SMS. This flaw resides in the admin/deletecourse.php file, allowing remote attackers to manipulate the ID GET request parameter. Successful exploitation could lead to unauthorized data access or modification by injecting malicious SQL code.

The National Vulnerability Database notes that the specific version of QueryMine SMS affected is not detailed due to its rolling release model. However, the vulnerability, rated HIGH with a CVSS score of 7.3, is publicly known and exploitable. The vendor was contacted but failed to respond, leaving users exposed.

Defenders should assume any deployment of QueryMine SMS is at risk. Given the lack of specific versioning and vendor engagement, proactive measures are paramount. Audit systems for unusual database queries originating from the web application and consider network segmentation to limit the blast radius if an incident occurs.