The vulnerability exists in the file manage_department.php of SourceCodester Online Employees Work From Home Attendance System version 1.0. It allows an attacker to inject arbitrary SQL statements through input handling in that script. The injected code can read from or write to the underlying database, which would compromise the confidentiality and integrity of employee attendance records. This weakness is a classic injection flaw categorized as CWE‑89.

The affected system is SourceCodester Online Employees Work From Home Attendance System v1.0. The flaw is present in the /wfh_attendance/admin/manage_department.php component; no other versions or products are listed, so the impact is confined to this specific deployment.

The CVSS score of 2.7 classifies the issue as low severity. An attacker could likely exploit the flaw through the public web interface, as the description does not indicate any authentication requirement and the vulnerable endpoint is accessible via HTTP. EPSS data is unavailable and the vulnerability is not yet listed in the CISA KEV catalog, suggesting that exploitation attempts may be rare but still possible. Administrators should treat the vulnerability as a low‑risk but exploitable condition until a patch or workaround is applied.