A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.

A critical vulnerability has been identified in itsourcecode Payroll System 1.0, specifically in the CRUD Operation Handler component. The flaw exists in the ajax.php file where manipulation of the 'action' argument can bypass authentication entirely. This missing authentication vulnerability affects the create, read, update, and delete functions. The attack can be performed remotely without any physical access requirement. A proof-of-concept exploit has already been published and is available for use, making active exploitation a significant risk. Organizations using this payroll system are advised to apply patches or mitigations immediately.