Executive brief
A security vulnerability exists in the CodeAstro Human Resource Management System, a platform used for managing employee records and company operations. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially allowing them to view, modify, or delete sensitive employee information. This could lead to a significant breach of privacy and disruption of HR business processes.
Technical details
A SQL injection vulnerability exists in CodeAstro Human Resource Management System 1.0 within the GetFileInfo function of hrsystem/application/models/Employee_model.php. The application accepts a base64-encoded 'I' parameter via a GET request at the /hrsystem/employee/view endpoint and passes it directly into a SQL query string without sanitization or parameterization. An authenticated attacker can provide a malicious base64-encoded payload to perform boolean-based blind, error-based, or time-based SQL injection. This allows for full extraction of database contents, modification of records, or denial of service via heavy queries. The vulnerability can be remediated by implementing prepared statements using CodeIgniter’s database layer.
Affected products
- CodeAstro Human Resource Management System 1.0
Timeline
- 2026-05-29: disclosed: Vulnerability discovered by security researcher Ashik Mohamed
- 2026-06-29: advisory: CVE-2026-13535 published to the NVD dataset