The vulnerability is a classic SQL injection that occurs when the Date parameter in daily-task-report.php is processed without proper sanitization. An attacker can inject arbitrary SQL, allowing data extraction or modification. The flaw stems from a developer mistake in handling GET values, specifically an unknown function that passes the Date argument straight into a query. This weakness is classified as CWE-74 and CWE-89. The impact is the potential compromise of data confidentiality and integrity on the system hosting the Employee Task Management System.

SourceCodester Employee Task Management System, version 1.0 and earlier. The issue resides in the daily-task-report.php file accessed via the GET parameter Date. The product is distributed under the oretnom23:employee_task_management_system package. No specific build or patch level is listed beyond 1.0, so any installation of the 1.0 release is affected.

CVSS v3.1 score of 5.1 indicates moderate severity. The EPSS score of less than 1 % reflects a very low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. The remote nature of the attack allows an unauthenticated or authenticated user to craft the Date parameter and inject SQL code. The published exploit demonstrates that this attack can be executed from a remote host without requiring privileged local access.