Mayuri K Employee Management System SQL Injection Vulnerability in Update_User.php

A critical SQL injection vulnerability has been identified in the Mayuri K Employee Management System, affecting versions up to 192.168.70.3. The issue arises in the file '/hr_soft/admin/Update_User.php', where the 'id' parameter can be manipulated to execute arbitrary SQL commands. This vulnerability can be exploited remotely, potentially allowing attackers to access or modify sensitive database information.

Impact

Exploitation of this vulnerability allows for blind SQL injection, where attackers can execute SQL commands that could lead to unauthorized data access or manipulation.

Reproduction

To reproduce this vulnerability, send a POST request to '/hr_soft/admin/Update_User.php' with an injected payload in the 'id' parameter. The injection can be crafted to exploit SQL query handling, such as using 'RLIKE' with a 'CASE' statement to verify the injection's success.