CVE-2026-15478: IceHRM SQL Injection Vulnerability

CVE-2026-15478 Overview

CVE-2026-15478 is a SQL injection vulnerability in IceHRM versions up to 35.0.1. The flaw resides in the EmployeeAttendanceReport.php file within the core/src/Reports/User/Reports/ directory, which handles the UserReport endpoint. Attackers can manipulate the employeeList argument to inject arbitrary SQL statements into backend database queries. The attack is executable remotely over the network and requires only low-privilege authentication. A public exploit has been published, and the maintainers have not responded to the issue report submitted through GitHub. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated remote attackers can inject SQL statements via the employeeList parameter to read, modify, or exfiltrate HR data stored in the IceHRM database.

Affected Products

• IceHRM versions up to and including 35.0.1
• Component: UserReport Endpoint (core/src/Reports/User/Reports/EmployeeAttendanceReport.php)
• Deployments using the affected employeeList request parameter

Discovery Timeline

• 2026-07-12 - CVE-2026-15478 published to NVD
• 2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15478

Vulnerability Analysis

The vulnerability exists in the Employee Attendance Report generation logic of IceHRM. The EmployeeAttendanceReport.php script accepts the employeeList argument from a user-controlled request and incorporates it into a SQL query without proper sanitization or parameterization. This allows an authenticated attacker to break out of the intended query context and append malicious SQL syntax. Because the UserReport endpoint is exposed over the network, exploitation does not require local access or user interaction. The published exploit lowers the barrier to abuse, though the confidentiality, integrity, and availability impact is limited to the scope of the IceHRM database user.

Root Cause

The root cause is improper neutralization of special elements passed through the employeeList parameter. The application concatenates untrusted input directly into a SQL statement rather than binding values through prepared statements. This design choice aligns with the CWE-74 injection class, where downstream interpreters process attacker-controlled data as code.

Attack Vector

An authenticated user with any low-privilege IceHRM account can send a crafted HTTP request to the UserReport endpoint. By supplying SQL metacharacters in the employeeList parameter, the attacker forces the backend to execute injected queries. Attack techniques include boolean-based, union-based, and time-based blind SQL injection to extract employee records, credentials, or session data. See the VulDB Vulnerability Details and the GitHub Issue Report for further technical context.

Detection Methods for CVE-2026-15478

Indicators of Compromise

• HTTP requests to core/src/Reports/User/Reports/EmployeeAttendanceReport.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the employeeList parameter.
• Database error messages or unusually long response times returned by the UserReport endpoint.
• Unexpected SELECT, UNION, or information_schema queries in MySQL/MariaDB query logs originating from the IceHRM application user.

Detection Strategies

• Enable database query logging and alert on queries referencing information_schema, mysql.user, or nested SELECT statements originating from the IceHRM service account.
• Deploy a web application firewall rule that inspects the employeeList parameter for SQL syntax and blocks requests containing injection payloads.
• Correlate authenticated session activity with anomalous report generation volume from a single user.

Monitoring Recommendations

• Monitor web server access logs for repeated POST or GET requests to the UserReport endpoint from the same session identifier.
• Track outbound network connections from the IceHRM host to detect data exfiltration attempts following successful injection.
• Baseline normal report query patterns and alert on deviations in query length, structure, or execution time.

How to Mitigate CVE-2026-15478

Immediate Actions Required

• Restrict network access to the IceHRM UserReport endpoint to trusted internal users through network segmentation or reverse proxy access controls.
• Audit IceHRM user accounts and revoke unnecessary access to reduce the pool of authenticated attackers who can reach the vulnerable endpoint.
• Enable database-level least privilege so the IceHRM service account cannot access sensitive tables or execute administrative statements.

Patch Information

No official patch is available. The maintainers of IceHRM have not responded to the GitHub Issue Report submitted for this vulnerability. Track the VulDB CVE Record for updates and apply vendor fixes as soon as they are released.

Workarounds

• Apply a web application firewall (WAF) signature to block SQL metacharacters in the employeeList parameter of requests to EmployeeAttendanceReport.php.
• Modify the affected PHP source to use parameterized queries or PDO prepared statements for the employeeList value if in-house patching is feasible.
• Temporarily disable the Employee Attendance Report feature by removing route access to core/src/Reports/User/Reports/EmployeeAttendanceReport.php until an upstream fix is released.

# Example WAF rule (ModSecurity) to block SQL injection payloads targeting employeeList
SecRule ARGS:employeeList "@rx (?i)(union(\s|\+)+select|sleep\s*\(|--|';|/\*)" \
  "id:1015478,phase:2,deny,status:403,\
  msg:'Potential SQL Injection in IceHRM employeeList (CVE-2026-15478)',\
  logdata:'Matched Data: %{MATCHED_VAR}'"