Executive brief
code-projects Employee Management System is a PHP-based web application for managing employee records. A SQL injection vulnerability in the admin login endpoint allows unauthenticated attackers to bypass authentication and gain unauthorized access to the entire system, including sensitive employee data and administrative controls.
Technical details
A SQL injection vulnerability exists in the process/aprocess.php file's admin login endpoint, where the "mailuid" POST parameter is concatenated directly into a SQL SELECT query without sanitization, escaping, or parameterized queries. The vulnerable code is: SELECT * FROM alogin WHERE email='$email' AND password='$password'. No authentication checks or session verification are enforced on this endpoint, allowing unauthenticated remote attackers to inject malicious SQL code. Attackers can extract database names, bypass login, and gain full database access via error-based or union-based SQL injection techniques. Remediation requires implementing prepared statements with parameter binding, input validation, and proper authentication controls.
Affected products
- code-projects Employee Management System 1.0
Timeline
- 2026-07-03: disclosed: Issue opened on GitHub
- 2026-08-20: advisory: CVE-2026-76764 published