Database reads and writes via crafted deletion identifier

SQL injection in Employee Management System 1.0 allows remote authenticated users to read or modify database data through delete.php. The delete.php handler treats the id query parameter as MySQL syntax rather than ordinary data, enabling time-based blind query execution. Administrative login is required to reach the employee deletion request, and successful exploitation exposes the application database to reads and writes.