Employee Management System CVE-2025-8172

Exploitation requires authenticated access with at least a login account on the Employee Management System (PR:L in CVSS vector). The attacker must have valid credentials to reach the /admin/index.php endpoint; unauthenticated remote access is not possible. The vulnerability exists only in version 1.0 and requires no special configuration - it is present in default deployments. No user interaction is required once authenticated. Exploitation is limited to the application's database scope; the CVSS Scope:Unchanged (SC:N) indicates SQL injection cannot escape the application context to affect the host system or other applications.

Multiple conflicting signals characterize this CVE's true risk profile. The initial description classifies it as critical, but the CVSS 4.0 vector produces only a 2.1 score with confined impact (VC:L/VI:L/VA:L and unchanged scope SC:N), indicating the vulnerability poses low severity in standardized scoring. The EPSS score of 0.06% (19th percentile) is exceptionally low, suggesting this vulnerability is rarely exploited despite public disclosure - a typical pattern for SQL injection in obscure, low-adoption software. The requirement for authenticated access (PR:L) is a significant limiting factor that reduces exposure compared to an unauthenticated SQL injection. However, the presence of public exploit code (E:P) means defenders cannot rely on obscurity. SSVC analysis would likely rate this as Defer: while exploitability is confirmed (public POC), the technical impact is limited by restricted scope, and the affected product has minimal deployment footprint. This appears to be a case of initially misclassified severity; the actual risk is considerably lower than the critical label suggests, though patching remains prudent for any organization using this product.

An authenticated admin user or an attacker who has obtained valid admin credentials sends a specially crafted HTTP request to /admin/index.php with a SQL injection payload in the Username parameter (e.g., Username=admin' OR '1'='1). The unvalidated input is concatenated into a SQL query, allowing the attacker to bypass authentication logic, extract sensitive employee data, or modify database records. Public exploit code is available to automate payload generation and delivery.