An unauthenticated SQL injection vulnerability in the Code-Projects Employee Management System allows remote attackers to bypass authentication and execute arbitrary database commands.

The application is susceptible to a time-based SQL injection vulnerability within the authentication logic. An unauthenticated attacker can inject malicious SQL payloads into the mailuid parameter via an HTTP POST request to the /370project/process/eprocess.php endpoint, which is processed without proper sanitization or parameterized queries.

Successful exploitation of this vulnerability allows an attacker to bypass authentication, extract sensitive employee data, modify or delete records, and potentially achieve full control over the application database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, as the flaw is remotely exploitable without requiring any prior system access.

Immediate Action: As there is no official vendor patch available, administrators should immediately restrict access to the /370project/process/eprocess.php endpoint or take the application offline until the source code can be manually hardened using prepared statements.

Proactive Monitoring: Security teams should monitor web server logs for anomalous POST requests to the login endpoint, specifically looking for SQL syntax patterns or unexpected time delays in server responses.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns, specifically targeting the mailuid parameter in POST requests.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the security researcher's write-up hosted on GitHub.

Due to the critical nature of this SQL injection vulnerability and the availability of public proof-of-concept code, immediate remediation is required to prevent unauthorized database access. If the software cannot be patched by implementing prepared statements to handle user input, it should be removed from production environments until a secure version is provided by the vendor.