Executive brief
CodeAstro Payroll System 1.0 contains a security flaw in its salary management component. This vulnerability allows an attacker to interfere with the underlying database by submitting specially crafted information through the salary rate fields. If exploited, this could lead to unauthorized access to sensitive employee financial data, modification of payroll records, or disruption of the payroll system's operations.
Technical details
A SQL injection vulnerability exists in CodeAstro Payroll System 1.0 within the /home_salary.php file. The application fails to properly sanitize or validate the 'rate' and 'salary_rate' POST parameters before using them in SQL queries. An authenticated remote attacker can exploit this by sending crafted payloads (such as time-based blind SQL injection) to manipulate database queries. This can result in unauthorized data retrieval, modification of database records, or full database compromise. The vulnerability has been publicly disclosed with proof-of-concept exploits available.
Affected products
- CodeAstro Payroll System 1.0
Timeline
- 2026-05-25: disclosed: Public disclosure via GitHub issues
- 2026-06-08: advisory: CVE published and NVD entry created