Executive brief
A security vulnerability exists in the CodeAstro Payroll System, a web application used for managing employee compensation and records. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive employee information or the unauthorized modification of payroll records. This could result in financial discrepancies, data privacy breaches, and disruption of business operations.
Technical details
A SQL injection vulnerability exists in CodeAstro Payroll System 1.0 within the /home_employee.php file (and potentially view_account.php). The root cause is the improper neutralization of the 'emp_id' GET parameter before it is used in a database query. A remote attacker with low privileges (authenticated user) can provide malicious SQL commands to perform boolean-based blind, error-based, or UNION-based attacks. Successful exploitation allows for unauthorized database access, sensitive data exfiltration, and potential data tampering. A public exploit (PoC) using sqlmap has been disclosed. No official patch is currently noted, but remediation should involve using prepared statements with parameterized queries.
Affected products
- CodeAstro Payroll System 1.0
Timeline
- 2026-05-11: disclosed: Public issue opened on GitHub with PoC details
- 2026-06-01: advisory: CVE published and NVD record created