A critical SQL injection vulnerability in the itsourcecode Payroll Management System allows unauthenticated remote attackers to manipulate database queries.

This flaw is a SQL injection vulnerability (CWE-89) located in the view_employee.php script. The application fails to properly sanitize the ID argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

The ability to perform unauthenticated SQL injection poses a significant risk to data confidentiality and integrity. Attackers could potentially extract sensitive payroll information, modify employee records, or bypass authentication mechanisms, leading to severe reputational damage and legal liability. With a CVSS score of 7.3, this high-severity vulnerability necessitates immediate attention to prevent unauthorized database access.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the application or take the system offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests containing SQL syntax, such as UNION, SELECT, or sleep commands, directed at view_employee.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting the vulnerable parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub repository reference.

The presence of a public exploit for this unauthenticated SQL injection vulnerability makes it a high-priority target for malicious actors. Given the lack of a vendor-provided patch, organizations must prioritize implementing compensating controls, such as WAF rules, and restricting access to the affected system to mitigate the risk of data exfiltration.