Username enumeration via unneutralized notes parameter

SQL injection in Employee Timeclock Software 1.01 allows remote authenticated users to enumerate valid usernames via crafted notes. The add_entry.php endpoint incorporates the notes parameter into a database query without neutralizing SQL syntax, allowing conditional IF and SLEEP expressions to create a timing oracle. Any valid application account can submit the request and infer whether each tested username exists from the response delay, without direct access to query results.