Unauthenticated account takeover via injectable email parameter

SQL injection in Employee Performance Evaluation 1.0 allows remote attackers to take over accounts and read database contents through the login email field. The login handler fails to neutralize the POST email value before using it in a MySQL query, enabling error-based and time-based blind payloads. No authentication is required because the injectable field is submitted on the login page; successful exploitation grants control of administrator and other accounts and access to stored data.