The vulnerability is a classic SQL injection that occurs in the /wfh_attendance/admin/view_employee.php file of SourceCodester Online Employees Work From Home Attendance System v1.0 because user input is not properly validated or sanitized. An attacker who can supply crafted input could cause the application to execute unintended SQL commands, potentially allowing unauthorized read, update, or delete operations on the employee attendance database, which would expose sensitive personnel data and disrupt data integrity.

The affected product is SourceCodester Online Employees Work From Home Attendance System version 1.0, a web‑based attendance tracking solution.

The CVSS score is not available and the EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is the public web interface of the admin page, meaning an attacker could exploit the flaw without needing prior authentication if the admin section is risk of exploitation is therefore high for installations that do not restrict or secure the admin path, potentially leading to unauthorized data disclosure or modification.