Executive brief
itsourcecode Payroll System is a web-based HR and payroll management application used to manage employee records, salaries, and attendance. A critical SQL injection flaw in the login function allows attackers to bypass authentication entirely and gain unauthorized administrator access to the system, exposing sensitive employee data including salaries, personal information, and attendance records.
Technical details
The vulnerability is a classic SQL injection (CWE-89) in the login() function of admin_class.php. The code uses extract($_POST) to import POST parameters as variables, then directly concatenates the unsanitized $username and $password into a SQL query without parameterization or escaping. An attacker can bypass authentication by injecting SQL syntax such as "admin'#" into the username field, which comments out the password check. The vulnerability is network-accessible via an unauthenticated POST request to ajax.php?action=login with no prior authentication required. Successful exploitation grants full administrator session privileges and access to all application data. Remediation requires replacing string concatenation with prepared statements and implementing password hashing (bcrypt).
Affected products
- itsourcecode Payroll System 1.0
Timeline
- 2026-07-11: disclosed
- 2026-08-24: advisory