A flaw in IceHRM’s EmployeeAttendanceReport.php allows an attacker to inject arbitrary SQL statements by manipulating the employeeList parameter. The injection stems from insufficient input validation (CWE‑74, CWE‑89) and can result in exposure of sensitive employee data or modification of database contents. The vulnerability is exploitable remotely by sending crafted HTTP requests that include a malicious employeeList payload, leading to arbitrary SQL execution against the backend database.

All installations of IceHRM version 35.0.1 or earlier are vulnerable. The flaw resides in core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the UserReport endpoint; systems running these unpatched files are at risk.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a low current exploitation probability; however, published exploits are available, meaning attackers could still target the flaw. The vulnerability is not listed in CISA KEV. An attacker can send a crafted employeeList payload over HTTP to the vulnerable endpoint and execute arbitrary SQL queries against the backend database.