The vulnerability is an unsanitized GET parameter Date in the daily-attendance-report.php script, allowing an attacker to inject arbitrary SQL statements. This flaw permits remote exploitation because the request need only be sent to the public URL. An attacker could read, modify, or delete data from the underlying database, leading to loss of confidentiality, integrity, or availability of business information. The weakness is a classic SQL injection (CWE‑89) with potential for broader command injection (CWE‑74).

SourceCodester Employee Task Management System version 1.0 is affected. The vulnerable component resides in the daily-attendance-report.php page, which is accessible through the web interface of the system. No other versions are listed as impacted in the available data.

The CVSS base score is 5.1, indicating a moderate risk. The EPSS score is below 1 %, suggesting low exploitation likelihood currently, and the issue is not yet listed in the CISA KEV catalog. However, the flaw can be exploited remotely with a crafted HTTP GET request to the Date parameter; no authentication or privileged access is required. Therefore, attackers can potentially insert malicious SQL payloads via the public web interface, which may expose sensitive data or corrupt the database. The absence of an official patch means organizations must mitigate the risk proactively.