This vulnerability is a time-based and boolean-based blind SQL injection in the login_userid parameter of login.php, enabling attackers to craft POST requests that use sleep functions or conditional statements to retrieve sensitive data from the database, including employee names and credentials. The flaw permits denial of confidential data and potential compromise of user information. The core weakness is a classic SQL injection attack (CWE-89).

The affected product is PHP Timeclock version 1.04. No other versions are listed as vulnerable, and the CNA identifies only this single version. Users deploying this version on any web server that processes login requests are at risk.

With a CVSS score of 8.8 the vulnerability is considered high severity. Although EPSS scores are not available, the absence of a KEV listing does not diminish the likelihood of exploitation, especially given the commonality of SQL injection. The attack vector is inferred to be a web-based POST request to login.php, requiring no credentials, thus an unauthenticated attacker can trigger the injection remotely even from external networks, provided the web application is reachable.