CVE-2026-37593
SQL Injection in SourceCodester WFH Attendance System Admin Panel
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | online_employees_work_from_home_attendance_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-37593 vulnerability is an SQL injection flaw that allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized data disclosure or manipulation within the attendance system's database.
Such unauthorized access or data breaches can compromise the confidentiality and integrity of personal or sensitive data stored in the system.
This can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal data against unauthorized access and breaches.
Can you explain this vulnerability to me?
CVE-2026-37593 is a critical SQL injection vulnerability found in the Online Employees Work From Home Attendance System v1.0 developed by Sourcecodester.
The flaw exists in the file /wfh_attendance/admin/view_att.php, specifically in the handling of the 'id' parameter in the URL query string.
Because the 'id' parameter is not properly sanitized or validated, an attacker can inject arbitrary SQL code into the database query.
This allows the attacker to execute unauthorized SQL commands, such as retrieving database information or manipulating data.
How can this vulnerability impact me? :
This SQL injection vulnerability can have serious impacts including unauthorized disclosure of sensitive data stored in the attendance system's database.
Attackers can manipulate or extract data by injecting malicious SQL commands, potentially compromising employee attendance records or other confidential information.
Such unauthorized access can lead to data breaches, loss of data integrity, and disruption of the attendance system's normal operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the `id` parameter in the URL `/wfh_attendance/admin/view_att.php` for SQL injection. An example command to test this is to send a crafted HTTP GET request with a payload that attempts a UNION-based SQL injection.
- Use a curl command to test the injection point, for example: curl "http://<target>/wfh_attendance/admin/view_att.php?id=1' union select 1,2,3,4,5,6,7,8,sqlite_version(),10,11,12--+"
- Observe the response for database version information or SQL errors indicating successful injection.
The vulnerability arises from improper sanitization of the `id` parameter, so any input that manipulates the SQL query structure can be used to detect it.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL injection vulnerability in the Online Employees Work From Home Attendance System v1.0, immediate steps include:
- Avoid using the vulnerable endpoint `/wfh_attendance/admin/view_att.php` with untrusted input until a fix is applied.
- Implement proper input validation and sanitization on the `id` parameter to prevent injection of arbitrary SQL code.
- Use parameterized queries or prepared statements instead of directly concatenating user input into SQL queries.
- Restrict access to the vulnerable admin page to trusted users only, possibly by enforcing stricter authentication and authorization.
- Monitor logs for suspicious activity targeting the `id` parameter in the URL.