code-projects Employee Management System CVE-2026-7115

Exploitation requires authenticated access to the application (PR:L in CVSS indicates low privilege authentication level needed, such as standard employee account). The 370project/delete.php endpoint must be accessible and accept the ID parameter without server-side restrictions or Web Application Firewall blocking. The application must process the ID parameter in SQL queries without parameterized statements, input encoding, or validation. No special configuration or non-default deployment mode is indicated; standard installation of version 1.0 is vulnerable. Exploitation is NOT limited to administrators - any authenticated user can craft the malicious request.

CVSS 5.3 with network accessibility (AV:N) but authenticated requirement (PR:L) creates a moderate baseline risk. The CVSS 4.0 vector shows limited confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L), suggesting database access rather than full system compromise. Exploitation probability marked as P suggests publicly known but not actively widespread. The presence of publicly available exploit code lowers attacker barrier significantly. Real-world risk depends critically on: (1) whether the application is internet-exposed or internal-only, (2) ease of obtaining authentication credentials, and (3) sensitivity of data stored in the Employee Management System. For organizations with strict internal access controls, risk is substantially lower than CVSS score suggests. For internet-facing deployments with weak authentication, risk is elevated. The limited scope of data access (not system-wide) reduces impact compared to higher-severity SQLi vulnerabilities.

An authenticated user (employee or contractor with application access) exploits the delete.php ID parameter by injecting SQL commands, such as modifying the query from 'DELETE FROM employees WHERE id=5' to 'DELETE FROM employees WHERE id=5 OR 1=1', enabling unauthorized data deletion or manipulation. With publicly available exploit code hosted on GitHub, discovery and exploitation by internal or external attackers with credentials is straightforward. Exploitation requires valid authentication credentials but does not require user interaction or administrative privileges.