The vulnerability resides in the Login function of admin_class.php, where the Username parameter is not properly sanitized, leading to a classic SQL injection flaw. An attacker can inject malicious SQL code through the login form and execute arbitrary queries against the database. This flaw permits the attacker to read, modify, or delete payroll data, potentially enabling full compromise of the database and the entire payroll system. The impact is significant because the flaw may allow attackers to compromise sensitive employee compensation information and undermine the integrity of the financial system.

The affected product is itsourcecode Payroll System version 1.0. The vuln affects the admin_class.php file used for authentication in this version. No other versions or components are mentioned as vulnerable.

The CVSS score of 6.9 indicates a moderate severity vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, which suggests limited publicly known exploitation. However, the flaw is explicitly stated to be exploitable remotely via the login endpoint. Once exploited, an attacker can read or alter data in the payroll database, potentially achieving complete data exposure or unauthorized transaction manipulation.