code-projects Employee Management System EUVD-2026-25832

Exploitation requires valid authentication credentials to access the Employee Management System (PR:L per CVSS vector). The attacker must be able to reach the 370project/cancel.php endpoint via network access. The vulnerable parameters (id and token) must be processed by the cancel.php script without input validation. No special configuration or non-default setup is required - the vulnerability exists in the base installation of version 1.0. The limiting factor is the authentication requirement; unauthenticated remote attackers cannot exploit this vulnerability without first obtaining valid employee credentials through credential theft, phishing, or insider threat.

This vulnerability presents moderate real-world risk despite a CVSS score of 6.3. The attack vector is network-based (AV:N) with low complexity (AC:L), but critically requires low privileges (PR:L), meaning only authenticated users can exploit it. This significantly limits the attack surface compared to unauthenticated remote code execution vulnerabilities. The EPSS score is not provided in the available data, so exploitation probability cannot be quantified from standard metrics. However, the public availability of proof-of-concept code combined with the straightforward nature of SQL injection attacks suggests elevated real-world risk among threat actors with employee access or those who obtain valid credentials. The lack of KEV (CISA Known Exploited Vulnerabilities) status cannot be confirmed from provided data, but public POC availability indicates verified exploitability. For organizations deploying this system, the primary risk depends on internal access controls: if employee credentials are well-protected and access logging is in place, exploitation likelihood is reduced. If credentials are weak or widely distributed, risk is significantly elevated.

An authenticated employee with valid credentials accesses the Employee Management System and crafts a malicious HTTP request to 370project/cancel.php with a SQL injection payload in the id or token parameter, such as id=' OR '1'='1. The vulnerable code concatenates this payload directly into the SQL query without sanitization, allowing the attacker to extract sensitive employee data, modify records, or delete information from the backend database. The low attack complexity means no special exploitation techniques or specific environment knowledge is required beyond valid login credentials.