CVE-2026-105776: SQL Injection in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL

This vulnerability allows an attacker to perform SQL injection via the Username parameter in the /admin_transaction.php file of the bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL. The injection can be initiated remotely without authentication, potentially leading to partial compromise of confidentiality, integrity, and availability as indicated by the CVSS vector. The product's rolling release model means no fixed versions are identified, and the vendor has not responded to the report. An exploit is publicly available.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 6.9 (medium) reflects limited but significant impact on confidentiality, integrity, and availability. No confirmed in-the-wild exploitation is reported yet, but a public exploit exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no fixed versions are available, users should monitor for updates from the project. Until a fix is released, restricting access to the /admin_transaction.php endpoint and implementing web application firewall rules to detect and block SQL injection attempts may reduce risk.