CVE-2023-0904: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of…

PriorityP260high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

1.68%

74.5th percentile

A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
employee_task_management_system_project	employee_task_management_system	—	—
sourcecodester	employee_task_management_system	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/etms/task-details.php↗

url/etms/task-details.php?task_id=765%27+and+false+union+select+1,version(),3,database(),user(),6,7,8--+-↗

commandtask_id=765' and false union select 1,version(),3,database(),user(),6,7,8-- -↗

→Monitor HTTP GET requests to task-details.php containing SQL injection patterns in the task_id parameter, specifically UNION SELECT payloads with URL-encoded single quotes (%27) and comment sequences (--+-). ↗
→The vulnerable parameter is task_id in task-details.php; alert on any task_id value containing SQL metacharacters (quotes, UNION, SELECT, --). ↗
→Low-privileged (employee-role) authenticated users can trigger this SQLi; correlate authenticated session activity against task-details.php SQL injection attempts, not just unauthenticated traffic. ↗
→The vulnerable sink is the unsanitized interpolation of $task_id directly into the SQL WHERE clause: WHERE task_id='$task_id'; look for raw string concatenation in task-details.php lines 27–30. ↗

·The exploit was tested on a locally hosted instance (Host: localhost); in production deployments the path prefix /etms/ may differ. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.