A flaw exists in itsourcecode Payroll Management System 1.0 where the manage_employee.php script incorporates the ID parameter directly into SQL queries without adequate sanitization. Manipulating this ID argument allows an attacker to execute arbitrary SQL statements, potentially exposing confidential payroll information, altering employee records, or deleting data. The vulnerability is classified as CWE‑74 and CWE‑89.

The affected product is itsourcecode Payroll Management System, specifically version 1.0 as indicated by the vendors and CPE information provided.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely via the /manage_employee.php endpoint, with an publicly available exploit that accepts a crafted ID parameter to inject SQL commands. No local privilege escalation requirements are mentioned in the provided data.