EUVD-2026-12361Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SQL payload in ID parameter
-
ExploitSend HTTP request to /manage_employee.php
-
ExecutionSQL injection executes in database query
-
ImpactAttacker retrieves or modifies employee data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default itsourcecode Payroll Management System 1.0 with /manage_employee.php endpoint accepting unsanitized ID parameter. |
| Impact | The CVSS 3.1 score of 7.3 (High) reflects significant risk with network-based attack vector (AV:N), low complexity (AC:L), and no required privileges (PR:N) or user interaction (UI:N). The impact is moderate across confidentiality, integrity, and availability (C:L/I:L/A:L). The exploit code maturity is marked as proof-of-concept (E:P), and a working exploit is publicly available on GitHub. While not currently in CISA's KEV catalog indicating no known active exploitation in the wild, the combination of public exploit availability, remote exploitability without authentication, and the sensitive nature of payroll systems makes this a priority for organizations using this software. The lack of EPSS data prevents probabilistic assessment, but the low attack complexity and public POC suggest moderate real-world exploitation risk. |
| Exploit ScenarioDerived | An attacker can remotely send a crafted HTTP request to /manage_employee.php with a malicious SQL payload in the ID parameter, requiring no authentication or user interaction. The publicly available proof-of-concept at https://github.com/ltranquility/cve_submit/issues/12 demonstrates the attack methodology. Successful exploitation could allow attackers to extract employee salary information, modify payment records, or delete critical payroll data, potentially causing significant financial and compliance impacts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
SQL injection in itsourcecode Payroll Management System 1.0 via the ID parameter in /manage_employee.php allows unauthenticated remote attackers to execute arbitrary SQL queries and access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. Organizations running this system should implement network-level protections and consider upgrading to a patched version once released.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in the Payroll Management System 1.0 by itsourcecode, specifically in the /manage_employee.php file where the ID parameter is not properly sanitized. This allows remote unauthenticated attackers to execute arbitrary SQL commands, potentially accessing, modifying, or deleting sensitive payroll data. A public proof-of-concept exploit is available on GitHub, though the vulnerability is not currently listed in CISA's KEV catalog.
RemediationAI
No patch or updated version is currently available from itsourcecode for this vulnerability. Organizations should immediately implement web application firewall (WAF) rules to filter SQL injection attempts targeting the /manage_employee.php endpoint, particularly monitoring the ID parameter for malicious payloads. As an interim measure, restrict network access to the Payroll Management System to trusted IP ranges only and implement strong authentication. Given the critical nature of payroll data and lack of vendor patch, consider migrating to a more secure payroll management solution with active security support. Monitor https://vuldb.com/?id.351147 for any updates on patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the Payroll Management System version 1.0 developed by itsourcecode, a PHP-based web application for managing employee payroll data. The CPE identifier cpe:2.3:a:itsourcecode:payroll_management_system:*:*:*:*:*:*:*:* confirms this is a web application vulnerability. As classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the issue stems from insufficient input validation where user-supplied data in the ID parameter is directly incorporated into SQL queries without proper sanitization or parameterization, allowing attackers to inject malicious SQL statements.
Know when Payroll Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /manage_employee.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Executive ViewAI
A critical SQL injection vulnerability in the Payroll Management System allows unauthenticated attackers to access, modify, or delete sensitive employee payroll data. With a public exploit available and no patch currently available, this poses an immediate risk to financial data integrity, regulatory compliance, and employee trust.
Implement WAF rules to filter SQL injection payloads in the ID parameter; disable or restrict network access to /manage_employee.php endpoint; enforce strict IP whitelisting for payroll system access; deploy database activity monitoring (DAM) to detect unauthorized queries; apply parameterized queries or prepared statements if source code modification is possible; consider disabling the vulnerable endpoint until remediation is available and performing payroll operations through an alternative system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in itsourcecode SQL Injection Vulnerabilities
View all 3More in Payroll Management System
View allSourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Rated critical severity (CVSS 9.8), this vul
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0.php?acti
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Rated medium severity (C
Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Rat
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands throug
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQ
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the
Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend d
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulner
SQL injection in code-projects Payroll Management System 1.0 via the ID parameter in /ajax.php?action=save_department al
Exploit-DB