SourceCodester Online Employees Work From Home Attendance System version 1.0 contains an SQL injection flaw in the file /wfh_attendance/admin/view_att.php. The flaw allows unsanitized user input to be incorporated into database queries, which is consistent with CWE‑89. While the description does not state the exact outcome, it is reasonable to infer that an attacker could execute arbitrary SQL statements against the database, potentially leading to unauthorized data disclosure. No specific exploitation details such as privilege escalation or remote code execution are mentioned, so the impact is limited to data‑related attacks.

The vulnerability is present in SourceCodester Online Employees Work From Home Attendance System version 1.0. The vendor and patch information are not provided. The affected component is the admin view_att.php script used to view attendance records.

The CVSS score of 2.7 indicates a low severity vulnerability. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no observed exploitation. Based on the description, the likely attack vector is remote access to the admin interface for which the view_att.php script is exposed, allowing an attacker to supply malicious input. There is no evidence in the data of existing exploit code or widespread exploitation.