The vulnerability is a classic SQL injection present in the file /wfh_attendance/admin/attendance_list.php of the SourceCodester Online Employees Work From Home Attendance System version 1.0. Attackers can inject malicious SQL statements through input fields that are directly concatenated into database queries, permitting unauthorized read, modification, or deletion of employee attendance data. This could expose sensitive personal information and allow manipulation of attendance records, potentially impacting payroll, compliance, and employee trust.

The affected product is SourceCodester Online Employees Work From Home Attendance System version 1.0, a web-based application used to track remote work attendance. No other vendor or product information is reported.

The flaw arises from unsanitized input in a publicly accessible web interface, making it easily exploitable by remote attackers. While a CVSS score and EPSS value are not provided, the nature of the flaw suggests a high risk of data compromise. The vulnerability is not listed in the CISA KEV catalog, and no official patch has been identified, so the likelihood of current exploitation cannot be determined. Attackers would likely gain unauthorized access to the database by crafting input that is injected into SQL queries.