Employee Management System CVE-2026-76764

No authentication is required - the vulnerable endpoint /process/aprocess.php is the pre-authentication Admin Login form, accessible to any network client before any session is established. The attack requires only HTTP network access to port 80 or 443 on the target server. No special configuration, feature flag, or non-default setting is needed; a default installation of code-projects Employee Management System 1.0 is sufficient. Exploitation is limited by: (1) the application must be network-accessible (internet-facing or reachable on an internal network); (2) the specific PHP file must be present and executable (standard for any functional installation); (3) impact is bounded by the database user's privileges - if the PHP application runs under a restricted DB account, mass data extraction or DROP operations may not be possible.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) characterizes this as a fully remote, low-complexity, unauthenticated attack with no user interaction required - the highest-risk exploitability profile. The E:P supplemental modifier confirms a public exploit exists, further compressing the time-to-exploitation window. Impact metrics are rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), suggesting the disclosed PoC demonstrates partial database interaction rather than full schema compromise; however, real-world SQL injection impact frequently exceeds initial PoC scope depending on database user privileges. The vulnerability is not listed in CISA KEV, and no EPSS score was provided - exploitation appears opportunistic rather than targeted. The product's niche footprint limits broad blast radius, but any internet-exposed instance should be treated as immediately at risk given the public exploit.

An unauthenticated attacker sends a crafted HTTP POST request to /process/aprocess.php with a SQL injection payload in the mailuid field, such as a classic ' OR '1'='1 or UNION-based string, causing the backend query to return all admin records or bypass password validation. A public exploit demonstrating this technique is documented at https://github.com/niaoniaollll/cve/issues/10, meaning automated scanning tools can trivially identify and exploit vulnerable instances without manual effort.