Executive brief
itsourcecode Payroll System is a web-based human resources and payroll management application. A critical flaw allows unauthenticated attackers to perform any administrative operation—including creating admin accounts, accessing employee records, modifying salary data, and deleting database contents—without providing any login credentials or valid session token.
Technical details
The vulnerability is a missing authentication flaw (CWE-306) in the ajax.php file's CRUD operation dispatcher. All action handlers (save_user, delete_user, and 20+ others) process requests based solely on a URL parameter without validating session state or user authorization. An unauthenticated attacker can directly invoke any administrative operation by crafting HTTP requests to /ajax.php?action=save_user or similar endpoints with crafted POST/GET parameters. No session_start(), $_SESSION validation, or CSRF token check is performed. The attack is network-accessible, requires no authentication or user interaction, and allows complete application compromise including database modification and lateral system access.
Affected products
- itsourcecode Payroll System 1.0
Timeline
- 2026-07-11: disclosed
- 2026-08-26: advisory