CVE-2026-108972: SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function sessionstart of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no prior privileges or user interaction. Exploitation involves manipulating the role, pfimg, or EmpId argument processed by controller/employee.php.
Is exploit code available?
Yes. The exploit has been made public, increasing the likelihood that unauthenticated remote attackers could attempt exploitation.
What security impact could successful exploitation have?
The reported impact includes limited compromise of confidentiality, integrity, and availability. The underlying issue is improper authentication in the Employee Endpoint.