SourceCodester Employee Management System eloginwel.php sql injection

Vulnerability

A critical SQL injection vulnerability exists in SourceCodester Employee Management System (unknown version) in the file eloginwel.php. The id parameter is not properly sanitized before being used in SQL queries, allowing an attacker to inject arbitrary SQL commands. The vulnerability is classified as critical and has been publicly disclosed [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted HTTP request to eloginwel.php with a malicious id parameter. No authentication is required. The exploit has been published, providing a proof-of-concept that demonstrates the injection [1].

Impact

Successful exploitation allows an attacker to read, modify, or delete arbitrary data in the database. Depending on database permissions, this could lead to data exfiltration, privilege escalation, or even remote code execution. The confidentiality, integrity, and availability of the application are at risk.

Mitigation

No official patch has been released by SourceCodester as of the publication date. Users should implement input validation and use parameterized queries to prevent SQL injection. Until a fix is available, it is recommended to restrict access to the vulnerable endpoint or disable the affected functionality.