Executive brief
A security vulnerability exists in the CodeAstro Human Resource Management System, a platform used for managing employee records and payroll. An attacker can exploit this flaw to gain unauthorized access to sensitive financial information, such as employee salary details and payroll records. This could lead to the exposure of private employee data and potential disruption of the organization's financial operations.
Technical details
A SQL injection vulnerability exists in CodeAstro Human Resource Management System 1.0 within the Payroll Invoice module. The flaw is located in the Invoice() function of the \application\controllers\Payroll.php file, where the 'Id' GET parameter is retrieved and passed directly to the getAllSalaryDataById() model function without proper sanitization or parameterization. A remote attacker with low-level privileges can manipulate this parameter to execute arbitrary SQL commands against the backend database. This allows for the extraction of sensitive payroll and employee information. A public exploit (PoC) has been disclosed.
Affected products
- CodeAstro Human Resource Management System 1.0
Timeline
- 2026-06-12: disclosed: Initial disclosure and CVE assignment
- 2026-06-12: advisory: NVD and VulDB published the advisory