SQL Injection Vulnerability in MD-MAFUJUL-HASAN Online Payroll Management System
CVE-2024-7117
Key Information:
- Vendor
Md-mafujul-hasan
- Vendor
- CVE Published:
- 26 July 2024
Badges
What is CVE-2024-7117?
A critical security vulnerability resides within the MD-MAFUJUL-HASAN Online Payroll Management System, where the function tied to the file /shift_viewmore.php is susceptible to SQL injection. This weakness arises when the 'id' argument is improperly handled, enabling attackers to execute unauthorized SQL queries against the database. Since this vulnerability allows for remote exploitation, unauthorized users could gain access to sensitive data and escalate their privileges. As this product employs a rolling release model, specific versions impacted by this vulnerability may not be disclosed. Users and administrators are strongly advised to implement security measures immediately and monitor the vendor's communications for any updates or patches.
Affected Version(s)
Online-Payroll-Management-System 20230911
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.