The flaw in SourceCodester Human Resource Management allows a remote attacker to tamper with the employeeid parameter in /detailview.php. By substituting a different employeeid value, the attacker can retrieve the personal details of any employee record, resulting in a breach of confidentiality. This improper control of resource identifiers is a classic IDOR vulnerability identified as CWE-99.

SourceCodester Human Resource Management version 1.0 is affected by this IDOR flaw on the /detailview.php page.

The CVSS base score is 5.3, indicating a moderate risk level. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely by simply sending a crafted request to /detailview.php with a manipulated employeeid value. Because the exploit requires no privileged access and relies only on predictable URL parameters, it presents a tangible threat to confidentiality if left unmitigated.