A flaw exists in the Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL, specifically the /admin_transaction.php handler. An attacker can manipulate the Username parameter to inject arbitrary SQL statements, allowing arbitrary read, write or delete operations against the underlying database. The vulnerability can be triggered remotely via normal HTTP requests and exploit code has already been published, enabling attackers to compromise data confidentiality and integrity or even elevate privileges if the database account used by the application has sufficient authority.

The affected product is bhagya3929's Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL. No specific version numbers are available because the project uses a rolling release model; the commit hash ae783195ba7e0390d3b3bfaddd99944b7e9735a4 marks the last known insecure state. All deployments of the application that include that or earlier code are vulnerable, and because no patch has been released yet, the flaw remains present across current releases.

The CVSS score is 6.9, indicating a moderate severity. EPSS is not available, so the likelihood remains unclear, but the vulnerability has been published and is publicly known. The vulnerability is not listed in CISA’s KEV catalog. Attackers can reach the flaw remotely through the web interface, and unless remedial controls such as parameterized queries or WAF are in place, exploitation can lead to significant data exposure or privilege escalation.