EUVD-2026-36604
GHSA-j9w5-f4cp-36h7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable injection requiring low-privilege authentication; no scope change; availability impact omitted as parameter-level SQL injection does not typically cause service disruption.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\controllers\Payroll.php of the component Payroll Invoice Module. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
SQL injection in CodeAstro Human Resource Management System 1.0 enables authenticated remote attackers to manipulate the unsanitized ID parameter within the Invoice function of application/controllers/Payroll.php, allowing arbitrary database reads and writes against the underlying HR and payroll data store. A public proof-of-concept exploit is hosted on GitHub, confirming the vulnerability is actively weaponizable by any attacker holding a low-privilege account. No vendor patch has been identified; the CVE is not in CISA KEV, but the CVSS 4.0 vector carries E:P (exploit published), reflecting confirmed public exploit availability.
Technical ContextAI
The affected component is the Invoice function inside application/controllers/Payroll.php, part of the Payroll Invoice Module in CodeAstro's PHP-based Human Resource Management System version 1.0. The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command), a classic unsanitized parameter injection where the ID argument is interpolated directly into a database query without parameterization or escaping. The CPE string cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, implying all distributed versions are potentially in scope, though only 1.0 is explicitly named in the advisory. CodeAstro products are PHP demo/educational applications commonly deployed in production without hardening, making real-world exposure plausible.
RemediationAI
No vendor-released patch has been identified at time of analysis. Given CodeAstro's nature as a demo/educational PHP application, a timely upstream fix cannot be assumed. The direct code-level fix is to refactor the Invoice function in application/controllers/Payroll.php to use prepared statements or parameterized queries for the ID argument, replacing any direct string interpolation into the SQL query. As a compensating control, deploying a WAF rule targeting SQL injection patterns on the payroll invoice endpoint can reduce exploitation likelihood without modifying application code, though WAFs can be bypassed by sufficiently obfuscated payloads. Restricting access to the Payroll Invoice Module by IP allowlist or role-based access control reduces the attacker pool to trusted network segments. The public PoC at https://github.com/ashikmd0507/CVE/tree/main/SQL-Injection-via-Payroll-Invoice-Module should be used to validate any remediation applied before returning the system to production.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today