Employee Movement Tracking And Monitoring Website For Iocl
Monthly
SQL injection in the Employee Movement Tracking and Monitoring Website for IOCL (a PHP project published at github.com/bhagya3929) allows remote attackers to manipulate the Username argument of /admin_transaction.php and inject arbitrary SQL. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N, E:P), no authentication or user interaction is required and publicly available exploit code exists, though the 'admin_' endpoint naming means defenders should verify whether the page is actually reachable pre-authentication. The impact is assessed as limited data confidentiality, integrity, and availability loss (VC:L/VI:L/VA:L), and practical priority is low because the project is a rolling-release hobby application with no packaged versions and a very small install base - exploitation depends on finding one of the few publicly reachable deployments. The maintainer was notified via a GitHub issue but has not responded, and no vendor-released patch has been identified.
SQL injection in the Employee Movement Tracking and Monitoring Website for IOCL (a PHP project published at github.com/bhagya3929) allows remote attackers to manipulate the Username argument of /admin_transaction.php and inject arbitrary SQL. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N, E:P), no authentication or user interaction is required and publicly available exploit code exists, though the 'admin_' endpoint naming means defenders should verify whether the page is actually reachable pre-authentication. The impact is assessed as limited data confidentiality, integrity, and availability loss (VC:L/VI:L/VA:L), and practical priority is low because the project is a rolling-release hobby application with no packaged versions and a very small install base - exploitation depends on finding one of the few publicly reachable deployments. The maintainer was notified via a GitHub issue but has not responded, and no vendor-released patch has been identified.