Executive brief
CodeAstro Payroll System, a web-based application for managing employee compensation, contains a security vulnerability in its account viewing and update functionality. An attacker with basic user access can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive employee financial records, unauthorized tampering with payroll data, or disruption of the payroll system's operations.
Technical details
A SQL injection vulnerability exists in CodeAstro Payroll System 1.0 within the /view_account.php and /update_account.php components. The root cause is the failure to properly sanitize or validate the 'id' parameter before using it in a database query. An attacker with low-level privileges can send a specially crafted HTTP POST request containing malicious SQL commands (such as time-based blind payloads). Successful exploitation allows for unauthorized database access, data leakage, and potential modification of payroll records. The vulnerability has been confirmed via public proof-of-concept exploits using tools like sqlmap.
Affected products
- CodeAstro Payroll System 1.0
Timeline
- 2026-05-25: disclosed: Initial discovery and issue report on GitHub
- 2026-06-08: advisory: NVD publication date