CVE-2026-37596
SQL Injection in SourceCodester WFH Attendance Manage_Department
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | online_employees_work_from_home_attendance_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-37596 vulnerability is an SQL injection in the Online Employees Work From Home Attendance System v1.0 that allows attackers to inject SQL code and retrieve database information. This type of vulnerability can lead to unauthorized access to sensitive employee data stored in the system.
Such unauthorized access and potential data leakage can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information. Failure to secure the system against SQL injection could result in breaches of confidentiality and data integrity, leading to regulatory non-compliance.
Can you explain this vulnerability to me?
CVE-2026-37596 is an SQL injection vulnerability in the Online Employees Work From Home Attendance System v1.0 developed by SourceCodester. It exists in the file /wfh_attendance/admin/manage_department.php, specifically in the 'id' GET parameter.
This vulnerability allows an attacker to inject malicious SQL code through the 'id' parameter in the URL, which can be used to manipulate the database query executed by the system.
For example, an attacker can use a payload like `/wfh_attendance/admin/manage_department.php?id=1' union select 1,sqlite_version(),3,4--+` to retrieve database information such as the SQLite version.
The root cause is insufficient input sanitization or lack of parameterized queries in the vulnerable script, and the system is accessible without additional authentication barriers, increasing the risk of exploitation.
How can this vulnerability impact me? :
This SQL injection vulnerability can allow attackers to access, modify, or delete sensitive data stored in the database of the attendance system.
Since the vulnerable page is accessible without authentication and the system uses default credentials (admin/admin123), attackers can exploit this flaw to leak confidential information or potentially escalate their access.
Such unauthorized database access can lead to data breaches, loss of data integrity, and disruption of the attendance system's normal operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This SQL injection vulnerability can be detected by testing the `id` GET parameter in the URL of the file `/wfh_attendance/admin/manage_department.php` for SQL injection payloads.
For example, sending a request with a payload like `/wfh_attendance/admin/manage_department.php?id=1' union select 1,sqlite_version(),3,4--+` can help confirm the vulnerability by attempting to retrieve the SQLite database version.
You can use tools like curl or a web browser to test this manually, or use automated SQL injection testing tools such as sqlmap targeting the vulnerable parameter.
- curl "http://<target>/wfh_attendance/admin/manage_department.php?id=1' union select 1,sqlite_version(),3,4--+"
- sqlmap -u "http://<target>/wfh_attendance/admin/manage_department.php?id=1" --batch
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable script `/wfh_attendance/admin/manage_department.php` to trusted users only, as it is accessible without authentication.
Additionally, changing default credentials (admin/admin123) to strong, unique passwords can reduce risk.
Longer term, the vulnerability should be fixed by implementing proper input sanitization or using parameterized queries to prevent SQL injection in the `id` parameter.