Employee Management System CVE-2026-9450

Exploitation requires a valid low-privilege authenticated session within the Employee Management System - unauthenticated anonymous exploitation is not possible per the CVSS PR:L vector. The vulnerable endpoint /psubmit.php must be reachable over the network, and the pid parameter must be user-controlled in the request. No non-default configuration setting is required; the vulnerability exists in the default application state. Limiting factors include: authenticated access is a hard prerequisite, reducing the exposed attacker population to users or compromised accounts; the SSVC framework rates the attack as not automatable, meaning mass exploitation campaigns are not straightforward; the product is a demo/educational PHP application, limiting realistic production deployment footprint; and EPSS at 0.03% reflects no observed mass scanning or exploitation at time of analysis.

The CVSS 4.0 score of 2.1 is low and consistent with the attack profile: network-reachable (AV:N), low complexity (AC:L), no attack requirements (AT:N), but requiring low-privilege authentication (PR:L), with only partial confidentiality, integrity, and availability impact on the vulnerable system and no scope change to other components. EPSS at 0.03% (8th percentile) confirms statistically negligible mass-exploitation probability, consistent with a niche demo application. No CISA KEV listing exists, indicating no confirmed active exploitation in the wild. The SSVC framework rates exploitation status as poc, automatable as no, and technical impact as partial - reinforcing that this is not a spray-and-pray threat but a targeted-credential-required attack. The primary real-world risk driver is the publicly available GitHub PoC, which lowers attacker skill requirements for anyone who already has application credentials. Given the educational/demo nature of this product, production exposure is expected to be limited, but organizations that have deployed it publicly should treat remediation as urgent.

An attacker with low-privilege credentials to the Employee Management System sends a crafted HTTP request to /psubmit.php with a SQL-injected pid parameter value such as '1 UNION SELECT username,password,3 FROM users--', bypassing the application's query logic. A public PoC hosted on GitHub demonstrates the specific payload and request structure, meaning exploitation requires minimal expertise beyond credential acquisition. The injected query executes in the database context of the application's service account, potentially exposing all records the account can access.