The vulnerability is a classic SQL injection flaw located in the /wfh_attendance/admin/manage_department.php page of the SourceCodester Online Employees Work From Home Attendance System v1.0. An attacker capable of inserting malicious SQL statements can read, modify, or delete database records, potentially exposing sensitive employee information or disrupting the attendance tracking process. The weakness is a failure to properly escape or parameterize user input, allowing unauthorized manipulation of data.

SourceCodester Online Employees Work From Home Attendance System version 1.0. The vulnerability resides in the /wfh_attendance/admin/manage_department.php file. No other affected versions or vendors are documented.

The flaw is exploitable via the web interface and does not require any special privileges beyond accessing the manage department page. Because the page likely handles administrative input, an unauthenticated or low‑privilege attacker could inject SQL commands. The lack of an CVSS score or EPSS value means the severity is unknown, but given the potential for data theft and integrity compromise, the risk should be considered high. Since the vulnerability is not listed in the KEV catalog, no known exploits have been reported yet, but the attack vector and impact suggest that an exploit could be developed quickly.