A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component C…

A critical vulnerability has been identified in itsourcecode Payroll System 1.0, specifically in the CRUD Operation Handler component. The flaw exists in the ajax.php file where manipulation of the 'action' argument can bypass authentication entirely. This missing authentication vulnerability affects the create, read, update, and delete functions. The attack can be performed remotely without any physical access requirement. A proof-of-concept exploit has already been published and is available for use, making active exploitation a significant risk. Organizations using this payroll system are advised to apply patches or mitigations immediately.