Code-Projects Payroll Management System SQL Injection Vulnerability in Update Account File

A critical SQL injection vulnerability has been identified in the Payroll Management System by Code-Projects, version 1.0. The issue resides in the 'update_account.php' file, where the 'deduction' parameter is manipulated, allowing for unrestricted SQL injection. This vulnerability can be exploited remotely, potentially affecting other parameters as well.

Impact

Exploitation of this vulnerability allows attackers to execute arbitrary SQL commands, which could lead to unauthorized data access or manipulation in the application's database.

Reproduction

To reproduce this vulnerability, send a POST request to 'update_account.php' with the 'deduction' parameter. The value of 'deduction' can be crafted to inject SQL commands, exploiting the application's SQL query handling.