PT-2024-26510 · Sourcecodester · Sourcecodester Human Resource Management System
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SourceCodester Human Resource Management System version 1.0
Description
A SQL injection issue allows attackers to execute arbitrary SQL commands via the
password parameter in the /hrm/user/ API endpoint.Recommendations
For SourceCodester Human Resource Management System version 1.0, consider restricting access to the
/hrm/user/ endpoint until a patch is available, and avoid using the password parameter in this endpoint to minimize the risk of exploitation.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sourcecodester Human Resource Management System