CVE-2026-37595
SQL Injection in SourceCodester WFH Attendance Employee Management
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | online_employees_work_from_home_attendance_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-37595 is an SQL injection vulnerability in the SourceCodester Online Employees Work From Home Attendance System v1.0. It exists in the file /wfh_attendance/admin/manage_employee.php, specifically in the 'id' GET parameter.
Because the 'id' parameter is not properly sanitized, an attacker can inject malicious SQL code. For example, they can use a UNION-based SQL injection payload to extract sensitive database information such as the SQLite version.
This vulnerability allows unauthorized execution of arbitrary SQL commands, leading to data leakage and potential further compromise of the database.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to sensitive data stored in the database of the attendance system.
An attacker exploiting this SQL injection can extract confidential information, manipulate database contents, or escalate the attack to compromise the entire database.
Such impacts can result in data breaches, loss of data integrity, and potential disruption of the attendance system's normal operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the `id` GET parameter in the file `/wfh_attendance/admin/manage_employee.php` for SQL injection. One way to do this is by sending crafted HTTP requests that include SQL injection payloads.
- Use a web browser or tools like curl or Burp Suite to send a request such as: `/wfh_attendance/admin/manage_employee.php?id=1' union select 1,2,3,sqlite_version(),5,6,7,8,9,10,11,12,13,14--+`
- Example curl command: `curl -i "http://<target>/wfh_attendance/admin/manage_employee.php?id=1' union select 1,2,3,sqlite_version(),5,6,7,8,9,10,11,12,13,14--+"`
If the response contains database information such as the SQLite version, it confirms the presence of the SQL injection vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL injection vulnerability in the Online Employees Work From Home Attendance System v1.0 allows unauthorized data leakage and potential database compromise. Such unauthorized access to sensitive employee data can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls to protect personal and health information from unauthorized access or disclosure.
By enabling attackers to extract database information through SQL injection, this vulnerability undermines the confidentiality and integrity of stored data, potentially resulting in non-compliance with standards that mandate safeguarding personal data and ensuring its privacy.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL Injection vulnerability in the file /wfh_attendance/admin/manage_employee.php, immediate steps include sanitizing and validating the 'id' GET parameter to prevent arbitrary SQL code execution.
Implement prepared statements or parameterized queries in the code to avoid direct concatenation of user input into SQL queries.
Restrict access to the vulnerable endpoint to authorized users only, considering the CVSS vector indicates a high privilege requirement.
Monitor and review logs for suspicious activity targeting the 'id' parameter to detect potential exploitation attempts.