Executive brief
CodeAstro Human Resource Management System, a platform used for managing employee records and leave requests, contains a security vulnerability in its leave update functionality. An authenticated user can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive employee information, disclosure of login credentials, or a complete compromise of the organization's HR data.
Technical details
A time-based blind SQL injection vulnerability exists in CodeAstro Human Resource Management System 1.0 within the Update_Earn_Leave endpoint. The vulnerability is located in the emselectByCode function of the application/models/Employee_model.php file, where the emid POST parameter is directly concatenated into a MySQL query string without sanitization or parameterization. An authenticated attacker can provide a crafted emid value containing SQL commands (e.g., using the SLEEP function) to perform database enumeration and extract sensitive data. While the exploit is public, no official patch has been confirmed in the advisory; remediation typically involves implementing prepared statements or using the CodeIgniter query builder.
Affected products
- CodeAstro Human Resource Management System 1.0
Timeline
- 2026-06-29: advisory: NVD publication date
- 2026-06-28: disclosed: Public exploit and vulnerability details shared via GitHub/VulDB