CodeAstro Payroll System CVE-2026-11559

Exploitation requires the attacker to possess a valid low-privilege user account within the CodeAstro Payroll System application (CVSS PR:L), ruling out anonymous or unauthenticated access. The specific vulnerable endpoint is /view_account.php, and the injectable parameter is 'ID' - exploitation is limited to this specific function in this specific file. No additional non-default configurations are required beyond the application being deployed and the attacker holding any authenticated session. Exploitation is limited by the authentication prerequisite and the contained impact scope (no database server OS-level or cross-application lateral movement indicated by SC:N). The attack vector is network-based (AV:N) with no attack requirements (AT:N), so any network-reachable deployment is in scope once credentials are obtained.

The CVSS 4.0 base score of 2.1 (Vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) requires careful interpretation. The network attack vector and low complexity confirm the endpoint is remotely reachable without special conditions, but PR:L mandates that the attacker hold a valid low-privilege account within the application - a meaningful friction point. The impact metrics are all Low, and scope is contained entirely within the vulnerable component with no subsequent system impact (SC:N/SI:N/SA:N), which significantly suppresses the overall score. The E:P modifier confirms the public PoC's existence, a real escalation signal. No KEV listing was identified, indicating no confirmed mass exploitation at time of analysis. No EPSS score was provided in source data, so probabilistic exploitation frequency cannot be quantified. For organizations running this specific application and version, the public PoC combined with trivially automatable SQLi tooling elevates practical risk above what the raw CVSS score suggests - particularly if the application is internet-facing and user accounts are broadly distributed.

An attacker with a valid low-privilege account in the CodeAstro Payroll System navigates to /view_account.php and appends a crafted SQL payload to the ID parameter - for example, appending a UNION SELECT statement - causing the backend PHP script to return payroll data belonging to other employees or system credentials stored in the database. A public PoC is available at https://github.com/Andelstander/cve/issues/1, which lowers the skill threshold for exploitation significantly; automated tools like sqlmap could be pointed at the endpoint by any authenticated user to enumerate the full database schema.