PT-2025-28162 · Unknown · Sourcecodester Employee Management System

Manyufan · Published 2025-06-28 · Updated 2025-07-07 · CVE-2025-7127

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: itsourcecode Employee Management System versions up to 1.0

Description: A critical issue was found in the itsourcecode Employee Management System. The problem affects the /admin/changepassword.php file, where the manipulation of the currentpassword argument leads to SQL injection. This issue can be exploited remotely.

Recommendations: For itsourcecode Employee Management System versions up to 1.0, consider disabling the changepassword functionality in the /admin/changepassword.php file until a patch is available. Restrict access to the /admin/changepassword.php file to minimize the risk of exploitation. Avoid using the currentpassword argument in the affected file until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

BDU:2025-08124

CVE-2025-7127

Affected Products

Sourcecodester Employee Management System

References · 12

• 🔥 https://github.com/manyufann/CVE/issues/3 · Exploit
• https://bdu.fstec.ru/vul/2025-08124 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-7127 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7127 · Vendor Advisory
• https://t.me/cvenotify/127822 · Telegram Post
• https://itsourcecode.com · Note
• https://vuldb.com/?submit.605935 · Note
• https://itsourcecode.com/free-projects/php-project/employee-management-system-php-mysql-source-code · Note
• https://twitter.com/VulmonFeeds/status/1942235385989407182 · Twitter Post
• https://twitter.com/CVEnew/status/1942199611319267337 · Twitter Post
• https://vuldb.com/?id.315039 · Note
• https://vuldb.com/?ctiid.315039 · Note