SQL Injection in IceHRM UserReport Endpoint

Detection Guidance

This vulnerability can be detected by testing the UserReport endpoint, specifically the EmployeeAttendanceReport and other report generation modules, for SQL injection via the employeeList argument.

Proof-of-concept attacks include time-based blind and error-based SQL injection techniques, which can be used to confirm the presence of the vulnerability.

Detection commands typically involve sending crafted HTTP requests with malicious payloads in the employeeList parameter to observe SQL injection behavior.

• Use curl or similar tools to send requests with SQL injection payloads, for example: curl -X POST -d '{"employeeList": "1 OR SLEEP(5)"}' https://your-icehrm-instance/core/src/Reports/User/Reports/EmployeeAttendanceReport.php
• Observe response delays or error messages indicating SQL injection vulnerability.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-15478 is an authenticated SQL injection vulnerability found in IceHRM up to version 35.0.1. It affects the UserReport endpoint, specifically the EmployeeAttendanceReport and other report generation modules. The vulnerability occurs because user input, specifically the employeeList argument, is directly embedded into SQL queries without proper validation or sanitization.

An authenticated user, even with basic 'Employee' role access, can exploit this flaw by manipulating the employeeList parameter to execute arbitrary SQL commands. This is possible because the code uses JSON-decoded input directly in SQL IN clauses without casting to integers or using parameterized queries, allowing attackers to perform SQL injection.

Proof-of-concept attacks include time-based blind and error-based SQL injection techniques. The vulnerability allows attackers to access or modify the database if the database user has sufficient privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to sensitive data stored in the IceHRM database. An attacker exploiting this SQL injection flaw can exfiltrate confidential information or modify data, potentially compromising the integrity and confidentiality of employee records and other HR data.

Since the attack can be launched remotely by an authenticated user, even those with limited privileges, it increases the risk of insider threats or compromised accounts being used to escalate access.

The ability to execute arbitrary SQL queries could lead to full database compromise depending on the database user's permissions, resulting in data breaches, data loss, or disruption of HR operations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves restricting access to the UserReport endpoint to trusted users only, especially limiting authenticated users with low privileges from accessing report generation modules.

Monitor and block suspicious requests that manipulate the employeeList parameter with unexpected input.

Apply input validation and sanitization by casting user-provided IDs to integers and using parameterized queries with placeholders to prevent SQL injection.

Since the project has not yet responded with a patch, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting this endpoint.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in IceHRM (CVE-2026-15478) allows an authenticated user to execute arbitrary SQL queries, potentially leading to full database access, data exfiltration, or modification.

Such unauthorized access and manipulation of sensitive employee data can result in violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over personal and health-related information.

Exploitation of this vulnerability could lead to breaches of confidentiality, integrity, and availability of protected data, thereby impacting compliance with these common standards and regulations.

Useful 0 Not Useful 0