The payroll management system allows arbitrary SQL commands to be executed through the employee view page, potentially enabling attackers to read or alter sensitive payroll data such as employee salaries and personal details. This flaw is a SQL Injection vulnerability identified as CWE-89, indicating improper handling of user input in SQL statements.

SourceCodester Payroll Management and Information System version 1.0, specifically the /payroll/view_employee.php page. No further vendor or version details are provided.

With a CVSS score of 9.1, the vulnerability is classified as critical. The EPSS score is not available, so the probability of exploitation remains uncertain. Based on typical attack patterns for SQL injection in web applications, it is inferred that an attacker who submits a crafted request to /payroll/view_employee.php could gain unauthenticated access to the database and read or modify sensitive payroll data, compromising data confidentiality and integrity. The vulnerability is not listed in the CISA KEV catalog, yet the high severity warrants urgent attention from security teams.