SQL Injection in Employee Tracking Admin Interface

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability represents a critical SQL injection flaw in an Employee Movement Tracking and Monitoring system used by IOCL. The flaw exists in the /admin_transaction.php file where unsanitized user input in the 'Username' parameter allows attackers to manipulate SQL queries. With a CVSS score of 7.3 and active public exploits available, this poses an immediate risk to organizations relying on this application. Threat actors can remotely execute arbitrary SQL commands, potentially gaining unauthorized access to sensitive employee data, modifying records, or escalating privileges within the application. Any organization using this tracking system should consider it a high-priority remediation target.

Casky's 754 security skills, powered by Claude's extended reasoning capabilities, map this attack to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) through detection of SQL injection patterns and input validation bypass attempts. Practitioners using the platform would observe 323 matching skills that flag suspicious query construction, parameter tampering, and database access anomalies. Specifically, the system would identify CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) patterns in web request logs, highlighting malicious SQL syntax in the Username field, unusual database command execution following web requests to /admin_transaction.php, and authentication bypass attempts. Security teams would see correlated findings showing reconnaissance activity followed by exploitation attempts, enabling them to distinguish this CVE's attack signature from other threats and implement targeted detection rules.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105776.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-105776

Casky has 323 skills that investigate the attack patterns behind CVE-2026-105776. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn