Employee Movement Tracking EUVD-2026-92963

Requires a reachable deployment of the Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL application with the /admin_transaction.php endpoint accessible to the attacker; exploitation injects SQL through the Username argument. The supplied CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed, but the endpoint's 'admin_' naming implies it may be intended for an authenticated administrative session - defenders should confirm whether the page is reachable pre-authentication. The primary limiting factor is deployment scarcity: this is a rolling-release hobby project with no packaged versions and a tiny install base, so realistic exposure depends on finding one of the few public instances.

Signals conflict on paper but converge on low practical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an easy, remote, unauthenticated attack, and a public exploit exists (VulDB, E:P 'Proof-of-Concept'), which normally raises urgency. However, the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L) with no subsequent-system impact, yielding a modest 6.9 base score, and the affected software is an obscure single-developer GitHub project (bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL). No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, so there is no evidence of real-world or widespread exploitation. Note a tension between the metadata and the artifact: the vulnerable endpoint is named /admin_transaction.php, implying an administrative context, yet the vector asserts PR:N (unauthenticated) - this should be verified against the actual code, as PR:N may be optimistic if the endpoint sits behind an admin login. Overall this reads as a high-CVSS-but-low-real-risk issue: credible and exploitable in a lab, but with negligible deployment footprint and no confirmed active abuse.

A remote attacker locates an internet-exposed instance of the IOCL employee-movement-tracking web application and sends a crafted request to /admin_transaction.php, injecting SQL metacharacters into the Username argument. Because the input is concatenated into a database query (CWE-89), the attacker reads or manipulates database records. A public proof-of-concept exploit has been published via the project's GitHub issue tracker, lowering the skill required.