SourceCodester Best Employee Management System salary_slip.php authorization

Vulnerability

The vulnerability resides in the /admin/salary_slip.php file of SourceCodester Best Employee Management System version 1.0. By manipulating the id parameter, an attacker can bypass authorization checks. The issue is accessible remotely without prior authentication [2].

Exploitation

An attacker can exploit the vulnerability by sending a crafted POST request to /admin/salary_slip.php with the id parameter set to a valid identifier (e.g., id=1). No authentication or special privileges are required, and the attack can be performed remotely [2].

Impact

Successful exploitation allows the attacker to view salary slip data of employees, leading to unauthorized disclosure of sensitive salary information. The impact is limited to information disclosure, with no further privilege escalation or system compromise described in the available references.

Mitigation

As of the publication date, the vendor has not responded to the disclosure and no official patch is available. Mitigation measures include restricting network access to the /admin/ directory, implementing additional authentication checks, or disabling the salary_slip.php endpoint until a fix is released.