CVE-2024-1199 is a Medium severity denial of service, scored 5.4, in CodeAstro Employee Task Management System 1.0. The flaw is in attendance-info.php, through the aten_id argument. The record names no fixed version, so keep the application off the public internet or fix the code.
What's affected
The record lists Employee Task Management System 1.0 from CodeAstro, in the file employee-tasks-php\attendance-info.php. Manipulating the aten_id argument leads to denial of service, and the attack can be launched remotely. The record says the exploit has been disclosed publicly.
No fixed version is named, and I could not read the VulDB entry or the linked document. CodeAstro publishes small PHP projects, so check for an update from them but plan on fixing or removing the code.
How to check if you're exposed
Search web roots for attendance-info.php and the employee-tasks-php folder.
find /var/www -name attendance-info.php 2>/dev/null
If found, check whether it is reachable from outside and look in access logs for repeated or unusual requests with the aten_id argument, especially ones that coincide with service slowdowns.
What to do now
- Find installs of the project on your servers.
- Take it offline or restrict it to a trusted network or VPN.
- Validate and type check the aten_id value on the server, and cap the resources a single request can use.
- Add rate limits at the reverse proxy.
- Check for an update from the author and re-test when one appears.
Why it matters
The class is uncontrolled or poorly handled resource use, CWE-404 in the record. Unvalidated input in a request causes the application to consume or fail in a way that stops it serving others.
For an internal attendance tool, denial of service is an annoyance more than a breach, which suits the 5.4 score. But small PHP projects like this are often deployed in HR environments where a login page and personal data share a server. Keep them away from the internet. The record's KEV flag is false.
Quick check
Is there a fixed version?
The record names none. It lists version 1.0 as affected.
How bad is a denial of service here?
It stops the application from serving users. The record does not list data theft for this CVE.
Sources
Last reviewed: 19 October 2026.
