CVE-2026-7114

Vulnerability

The Employee Management System version 1.0 by code-projects contains a SQL injection vulnerability in the /370project/edit.php script. The id parameter, received via a GET request, is directly concatenated into an SQL query without proper sanitization or parameterization, allowing an attacker to inject arbitrary SQL commands [1].

Exploitation

The vulnerability can be exploited remotely without authentication. An attacker only needs to send a crafted GET request to the vulnerable endpoint with a malicious payload in the id parameter. The provided proof of concept demonstrates a time-based blind injection using a sleep(10) command to confirm database execution [1].

Impact

Successful exploitation enables an attacker to extract sensitive data from the database, bypass query logic to access unauthorized records, and potentially degrade service availability through time-delay queries. The impact depends on the database user permissions, but at minimum, confidentiality and integrity can be compromised [1].

Mitigation

As of the publication date, no official patch has been released. The vendor's website (code-projects.org) hosts the source code, but the project appears unmaintained. The recommended mitigation is to replace direct parameter concatenation with prepared statements or parameterized queries in the edit.php file, and to perform input validation and least-privilege database access.