A critical SQL injection vulnerability in itsourcecode Human Resource Management System 1.0 allows for remote unauthorized database manipulation.

This is a SQL injection vulnerability caused by improper neutralization of special elements used in an SQL command within the eventSubject argument in /src/store/EventStore.php. The attack is remotely exploitable and does not require authentication.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive database information, potential data modification, or service disruption. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of human resource records stored within the application.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected application and implement input validation rules to sanitize the eventSubject parameter.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL syntax or unauthorized access attempts originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up located at the referenced GitHub repository.

The presence of a public proof-of-concept for this SQL injection vulnerability significantly elevates the risk of exploitation. Organizations utilizing this software must prioritize implementing defensive measures, such as WAF filtering, and actively seek confirmation from the vendor regarding a permanent security update to remediate the underlying code flaw.