The vulnerability resides in the delete.php script of the Dav-ee dairy-management-system. An attacker can manipulate the e_payroll_no parameter passed to mysqli_query to execute arbitrary SQL commands. This flaw allows the attacker to read, modify, or delete data from the database, potentially compromising the integrity and confidentiality of employee records.

Products affected are Dav-ee dairy-management-system. No specific version information is available, as the project follows a rolling release model, so all current releases before a fix may be vulnerable.

The CVSS score of 5.1 indicates a medium severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited or unverified exploitation activity. However, the description states the attack can be initiated remotely, implying that an attacker does not need local access to exploit the flaw. Without a publicly known exploit, the immediate risk is moderate, but the potential for data compromise is significant.