CVE-2024-35469

Submitter: Kha Do

Human Resource Management System 1.0

Vulnerability

SQL injection

Description

SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the password parameters.

Affected component

/hrm/user/

Impact

The attacker can use payload 'or'1'='1 login with administrator account without credentials.

POC

Login with anonymous

Source code contain vulnerability

Video

PoC_Video.mp4