| Title | bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL 1.0 SQL Injection |
|---|
| Description | A SQL Injection vulnerability exists in the `username` parameter of the `admin_transaction.php` file in the Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL application, version <= v1.0.
The application directly incorporates the user-controlled `username` parameter into an SQL query without using prepared statements or sufficient parameterization. As a result, an attacker can provide specially crafted SQL input that alters the intended query structure.
The vulnerability is exploitable as a time-based blind SQL injection. By injecting database expressions that cause a measurable delay when a specified condition is true, an attacker can infer information from the database even when query results are not directly returned in the application's response.
Successful exploitation may allow an unauthenticated or authenticated attacker, depending on access to the affected functionality, to infer database information and potentially access or manipulate data within the privileges available to the application's database account.
The affected source code and reproduction details have been reported to the project maintainer through GitHub Issue #1:
https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/issues/1
|
|---|
| Source | ⚠️ https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/issues/1 |
|---|
| User | Sudais_Nazir (UID 99014) |
|---|
| Submission | 09/20/2026 10:56 (16 days ago) |
|---|
| Moderation | 10/05/2026 22:30 (15 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 413810 [bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL /admin_transaction.php sql injection] |
|---|
| Points | 20 |
|---|