CodeAstro Payroll System CVE-2026-11558

Exploitation requires a valid low-privilege authenticated session on the CodeAstro Payroll System, confirmed by the CVSS 4.0 vector field PR:L (Low Privileges Required). The specific vulnerable endpoint is /home_salary.php and the injectable parameters are rate and salary_rate - no other configuration or feature flag is required beyond having access to this page. The attack is executable remotely over a network (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N). What limits exploitation: an attacker must first obtain valid application credentials for a low-privilege account, which means the risk is bounded by the strength of the application's authentication controls. The impact is further limited to the database tables accessible by the application's configured database user. Non-default configurations (e.g., network isolation, WAF) would raise the effective difficulty.

The CVSS 4.0 score of 2.1 is notably low despite the network-accessible attack vector (AV:N), and this is primarily driven by the low-privilege authentication prerequisite (PR:L) and uniformly low impact scores across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no subsequent system impact (SC:N/SI:N/SA:N). The E:P modifier confirms publicly available proof-of-concept code, which modestly elevates practical exploitation risk. However, the vulnerability is not listed in the CISA KEV catalog, and no EPSS score was provided in the source data. Real-world risk is further bounded by the likely limited deployment footprint of CodeAstro Payroll System - a small PHP application primarily used in educational or small-business contexts rather than enterprise environments. The existence of public POC code (GitHub) does mean that the bar to exploit is low for anyone who already holds a valid low-privilege account, making insider threat or credential compromise scenarios the most plausible path to exploitation. This is a low-severity, moderate-feasibility issue: prioritize remediation behind higher-CVSS or KEV-listed vulnerabilities, but do not dismiss it in environments where payroll data confidentiality is regulated.

An attacker who has obtained a valid low-privilege account on the CodeAstro Payroll System - either through credential theft, default credentials, or account creation - navigates to /home_salary.php and submits a crafted HTTP request with SQL injection payloads embedded in the rate or salary_rate parameters (e.g., rate=1 UNION SELECT username,password FROM users--). Because publicly available exploit code exists on GitHub (https://github.com/Andelstander/cve/issues/2), the attack can be replicated with minimal technical skill. The result may include unauthorized extraction of payroll records, employee data, or credential hashes stored in the application database.