Code-Projects Payroll Management System SQL Injection Vulnerability in View Account PHP

A critical SQL injection vulnerability has been identified in Code-Projects Payroll Management System version 1.0. The issue arises in the file '/view_account.php', where the 'salary_rate' parameter is manipulated, allowing for unrestricted SQL injection. This vulnerability can be exploited remotely, potentially leading to unauthorized access to sensitive information in the server database.

Impact

Exploitation of this vulnerability allows for unrestricted SQL injection, enabling attackers to manipulate database queries and access or modify database information.

Reproduction

To reproduce this vulnerability, send a POST request to '/view_account.php' with the 'salary_rate' parameter. The application will execute the parameter value in an SQL statement without proper validation, allowing for SQL injection.