Employee Management System EUVD-2026-25820

Exploitation requires a valid authenticated session in code-projects Employee Management System 1.0 (PR:L - login credentials or stolen session token required). The attack is triggered by sending a crafted HTTP GET or POST request to the edit.php endpoint with a SQL injection payload in the ID parameter. No special configuration or non-default settings are required beyond basic web server deployment. The vulnerability is limited to the edit.php functionality; other endpoints may not be affected if they implement parameterized queries. Exploitation is blocked if the application enforces strict input type validation (whitelist numeric-only ID) or if the database user lacks permissions to execute UNION queries or access sensitive tables.

CVSS 5.3 with CVSS:4.0 vector indicates moderate but constrained risk. The critical signals are: AV:N (network-accessible), AC:L (low complexity), and PR:L (requires login), balanced against limited scope (S:X implies likely unchanged scope) and restricted impact (VC:L, VI:L, VA:L - low confidentiality, integrity, and availability impact). E:P indicates proof of concept is available, elevating practical risk. EPSS is not provided, but the combination of authentication requirement, limited impact scope, and public POC availability suggests this affects a smaller attack surface than unauthenticated network RCE vulnerabilities. Real-world risk depends on deployment: organizations running this open-source Employee Management System in production (likely small organizations or internal deployments) face moderate SQL injection risk if users are trusted or if account credentials are compromised. The public exploit lowers the barrier for opportunistic attackers but does not indicate active widespread exploitation.

An authenticated user with valid credentials logs into the Employee Management System, navigates to the employee edit page, and modifies the ID parameter from a legitimate value (e.g., /370project/edit.php?ID=5) to an SQL injection payload such as /370project/edit.php?ID=5' UNION SELECT email, password FROM users -- . The vulnerable code concatenates this unsanitized input directly into the SQL query, returning the password hash of all users in the application. The attacker can then escalate privileges, access sensitive employee records (salary, personal details), or modify records to grant themselves administrative rights.