SQL Injection Vulnerability in MD-MAFUJUL-HASAN Online Payroll Management System
CVE-2024-7119
Key Information:
- Vendor
Md-mafujul-hasan
- Vendor
- CVE Published:
- 26 July 2024
Badges
What is CVE-2024-7119?
The MD-MAFUJUL-HASAN Online Payroll Management System contains a serious SQL injection vulnerability in the file /employee_viewmore.php. This vulnerability arises from insufficient input validation of the 'id' argument, allowing attackers to manipulate SQL queries and execute unauthorized commands remotely. The risk is elevated due to the continuous delivery model used by the vendor, resulting in the lack of specific version information for identified vulnerabilities. The vulnerability has been publicly disclosed, which increases the likelihood of exploitation. The vendor was notified of this issue but has not issued a response or patch to address the vulnerability, leaving users at risk.
Affected Version(s)
Online-Payroll-Management-System 20230911
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.