The vulnerability resides in the SourceCodester Payroll Management and Information System v1.0, specifically in the /payroll/view_account.php endpoint. The script accepts an employee ID through an HTTP GET parameter without proper input validation or sanitization, enabling an attacker to inject arbitrary SQL commands. This flaw can lead to the disclosure of sensitive payroll data and potentially the alteration or deletion of records, compromising the confidentiality and integrity of the system.

The only documented affected product is SourceCodester Payroll Management and Information System version 1.0. No specific vendor or additional product versions are listed. A system running this application and exposing the /payroll/view_account.php page is directly impacted.

Because the vulnerability is exploitable via a standard web request, the attack vector is likely remote, requiring only the ability to send crafted URLs to the target server. The CVSS score is 4.7, reflecting a moderate risk that still allows an attacker to read and potentially modify sensitive payroll data if exploited. The vulnerability is not currently cataloged in CISA's KEV, but the absence of a patch or mitigation advice does not diminish its severity.