This vulnerability in IceHRM up to version 35.0.1 allows remote attackers to perform SQL injection via the employeeList parameter in the UserReport Endpoint (core/src/Reports/User/Reports/EmployeeAttendanceReport.php). The flaw enables attackers to manipulate SQL queries, potentially compromising data integrity or confidentiality. The issue was reported early to the project, but no official fix or remediation guidance has been provided. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized SQL query execution on the affected IceHRM system, potentially exposing or altering sensitive employee attendance data. The attack can be launched remotely with low complexity and does not require user interaction, increasing the risk of exploitation. However, the impact is rated as limited in confidentiality, integrity, and availability according to the CVSS vector.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisories for updates and consider implementing temporary mitigations such as input validation or restricting access to the affected endpoint if possible. Since the vendor has not responded yet, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.