Executive brief
CodeAstro Human Resource Management System (HRMS) is a web-based platform used by organizations to manage employee data and departments. A security flaw allows an attacker to trick an authorized administrator into unintentionally deleting department records. This could lead to the loss of organizational data and disruption of HR operations if an administrator visits a malicious link while logged into the system.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Delete_dep function within the Organization controller of CodeAstro HRMS 1.0. The application fails to implement anti-CSRF tokens or origin validation for state-changing requests at the 'hrsystem/organization/Delete_dep/' endpoint. An attacker can craft a malicious HTML page or link that, when visited by an authenticated administrator, triggers a request to delete a department. Because department IDs are sequential and predictable, an attacker can easily target specific records. The vulnerability is rooted in the 'Delete_dep' function in 'application/controllers/Organization.php', which only checks for a valid session but not the intent or origin of the request.
Affected products
- CodeAstro Human Resource Management System 1.0
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory