SQL Injection Vulnerability in MD-MAFUJUL-HASAN Online Payroll Management System
CVE-2024-7116
Key Information:
- Vendor
Md-mafujul-hasan
- Vendor
- CVE Published:
- 26 July 2024
Badges
What is CVE-2024-7116?
A serious SQL injection vulnerability exists in the MD-MAFUJUL-HASAN Online-Payroll-Management-System, specifically affecting the handling of parameters in the /branch_viewmore.php file. Manipulation of the 'id' argument can allow attackers to execute unauthorized SQL queries, potentially leading to unauthorized access to sensitive information within the system. This vulnerability impacts all versions up to 20230911 and can be exploited remotely, which raises significant security concerns. The vendor has been unresponsive to security notifications, increasing the urgency for users to assess their exposure and implement appropriate mitigations.
Affected Version(s)
Online-Payroll-Management-System 20230911
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.