IceHRM CVE-2026-15478

Exploitation requires a valid authenticated IceHRM session with at least low-privilege credentials and access to the UserReport functionality - specifically the EmployeeAttendanceReport endpoint. In typical IceHRM deployments, this access is granted to HR staff, managers, and in some configurations employees viewing their own reports, making the qualifying user population potentially large within an organization. The attacker must be able to supply a crafted employeeList parameter in an HTTP request to the endpoint. Exploitation is bounded by: (1) mandatory authentication with a valid IceHRM account - unauthenticated external attackers cannot reach this endpoint directly; (2) user-level access to the attendance reporting feature, which may be restricted by role configuration. There is no requirement for a non-default configuration - any IceHRM deployment where low-privilege users can run employee attendance reports is directly exposed. No special network position beyond HTTP access to the IceHRM instance is required.

The CVSS 4.0 base score of 5.3 (Medium) reflects network exploitability (AV:N), low complexity (AC:L), no special attack conditions (AT:N), but requires low-privilege authentication (PR:L) and yields only limited impact (VC:L/VI:L/VA:L) with no scope change to subsequent systems (SC:N/SI:N/SA:N). This is not a high-severity unauthenticated mass-exploitation scenario - the PR:L constraint restricts the attacker pool to users holding valid IceHRM credentials with access to the reporting feature. However, in HR software deployments, this describes a very broad internal user population (employees, managers, HR staff), meaningfully expanding the realistic attacker surface. The publicly available PoC (GitHub issue #376) lowers the skill barrier for exploitation. The vendor's failure to respond to the disclosure eliminates any near-term remediation timeline, compounding risk over time. No EPSS data was provided; no CISA KEV listing means large-scale opportunistic exploitation is not confirmed, suggesting the current threat is primarily from insiders or targeted intrusions with valid credentials rather than automated scanning campaigns.

An authenticated IceHRM user - such as an HR manager or an employee with reporting access - submits a crafted HTTP request to the EmployeeAttendanceReport endpoint, injecting SQL syntax into the employeeList parameter using the publicly documented technique from GitHub issue #376. The injected query extracts sensitive employee records, payroll data, or attendance history from the backend database, or modifies records to falsify attendance data. The low attack complexity and availability of a public PoC make this accessible to non-expert insiders.