SQL Injection Vulnerability in MD-MAFUJUL-HASAN Online Payroll Management System
CVE-2024-7118
Key Information:
- Vendor
Md-mafujul-hasan
- Vendor
- CVE Published:
- 26 July 2024
Badges
What is CVE-2024-7118?
Recent analysis has revealed a severe SQL injection vulnerability in the MD-MAFUJUL-HASAN Online Payroll Management System, specifically within the 'department_viewmore.php' functionality. This vulnerability arises from improper handling of the argument 'id', allowing an attacker to manipulate input parameters and execute arbitrary SQL commands. The exploit can be executed remotely, putting sensitive user data at risk and potentially compromising the entire database. Despite the disclosure of this vulnerability, the vendor has not responded to inquiries or provided updates on remediation efforts, highlighting the urgent need for users to assess their systems for exposure.
Affected Version(s)
Online-Payroll-Management-System 20230911
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.