Code-Projects Employee Record System SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in Code-Projects Employee Record System version 1.0. The issue arises in the file '/dashboard/getData.php', where the 'keywords' parameter can be manipulated to execute arbitrary SQL commands. This vulnerability can be exploited remotely, and the details of the exploit have been disclosed publicly.

Impact

Exploitation of this vulnerability allows for SQL injection, which could lead to unauthorized data access or manipulation in the application's database.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the dashboard. Send a POST request to '/dashboard/getData.php' with the 'keywords' parameter crafted to include SQL injection payloads. The application does not properly sanitize the input, allowing the injected SQL to be executed.