The itsourcecode Payroll System 1.0 contains a SQL injection vulnerability in the Login function within admin_class.php. An attacker can remotely exploit this by manipulating the Username parameter, potentially leading to unauthorized data access or modification. The vulnerability is identified as CWE-74 and has a CVSS 3.1 base score of 7.3, indicating a moderate level of risk. Although an exploit has been publicly disclosed, there is no information about an official patch or fix from the vendor.

Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely via the Username parameter, potentially leading to unauthorized data disclosure, data modification, or denial of service. The CVSS vector indicates low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected system and consider implementing web application firewall rules to detect and block SQL injection attempts targeting the Login function.