code-projects Employee Management System CVE-2026-7117

Exploitation requires valid user authentication (PR:L rating in CVSS vector) to access the Employee Management System and reach the approve.php endpoint. The vulnerability is triggered when user-supplied id and token parameters are submitted to the approve.php file without input sanitization. No special configuration or non-default settings are mentioned; any deployment of version 1.0 with the file accessible to authenticated users is vulnerable. Attack complexity is low (AC:L), meaning no special timing, race conditions, or brute-force activity is necessary - a single crafted request triggers the vulnerability. The scope is unchanged (S:U), meaning impact is confined to the affected system's database without crossing trust boundaries.

CVSS vector AV:N/AC:L/PR:L indicates this is a network-accessible vulnerability with low attack complexity requiring only low-level user privileges (authenticated access). EPSS data is unavailable, but the combination of authenticated requirement (PR:L) and public exploit availability suggests moderate real-world risk constrained by the authentication barrier. The E:P (Exploit maturity: Proof-of-Concept) flag confirms exploit code availability. Unlike unauthenticated SQLi vulnerabilities, this requires an attacker to first gain valid user credentials or session access, reducing the attack surface significantly. However, organizations deploying this system with weak password policies or shared credentials among staff face elevated risk. The low impact scores (C:L/I:L/A:L) indicate the vulnerability does not grant full database compromise or system-level access, but attackers can read sensitive employee data, modify records, or cause service disruption.

An authenticated employee with low-level user access logs into the Employee Management System and discovers the vulnerable approve.php endpoint. The attacker crafts a malicious HTTP request injecting SQL syntax into the id parameter, such as id=1' OR '1'='1, allowing them to bypass approval logic and extract employee records from the database or modify approval statuses without authorization. Public exploit code from the referenced GitHub repository (zzzxc643/CVE1) details the exact injection payload syntax required.