CodeAstro HRMS CVE-2026-12131

Exploitation requires a valid authenticated session with at minimum low-privilege access to the Payroll Invoice Module - the CVSS 4.0 PR:L metric confirms this. The attacker must be able to send HTTP requests to the Invoice function in application/controllers/Payroll.php with a controllable ID parameter value. No non-default configuration is required beyond a standard deployment of CodeAstro HRMS 1.0 with the Payroll module enabled, which is part of the default feature set. The primary exploitation limit is the authentication barrier (PR:L): unauthenticated external attackers cannot trigger this vulnerability without first obtaining valid credentials through phishing, credential stuffing, or other means. The actual depth of database access is additionally bounded by the SQL user privileges configured for the application's database connection.

The CVSS 4.0 base score of 5.3 (Medium) is tempered by the PR:L requirement - authentication is mandatory, ruling out unauthenticated mass exploitation. However, the E:P exploit modifier confirms a public PoC exists on GitHub, meaningfully closing the gap between theoretical and realized risk. Impact metrics are rated Low across confidentiality, integrity, and availability in the CVSS 4.0 vector, but SQL injection impact is often underestimated at the CVSS level: depending on database user privileges, an attacker may achieve full table dumps or data manipulation beyond what Low ratings imply. No EPSS data was provided, preventing probabilistic exploitation comparison. The CVE is not in CISA KEV, so no confirmed active exploitation in the wild has been recorded. Real-world priority is moderate: highest for organizations where HR/payroll data sensitivity is elevated and where low-privilege HRMS accounts are broadly distributed to staff.

An attacker with a low-privilege HRMS account - such as a standard employee or contractor - authenticates to the application and navigates to the Payroll Invoice Module, sending a crafted HTTP request with a SQL-injected ID parameter to the Invoice function endpoint. Using the publicly available PoC on GitHub as a template, the attacker iterates through payroll records, extracting salary data, employee PII, or credentials stored in the database. If the database user has write permissions, the attacker can further alter payroll records or pivot to other application functions.