CodeAstro HRMS CVE-2026-13525

Exploitation requires a valid low-privilege user account within the CodeAstro Human Resource Management System application - unauthenticated exploitation is not possible given PR:L in the CVSS vector. The attacker must have network access to the Update_Earn_Leave HTTP endpoint. The vulnerable code path is the emselectByCode function in application/models/Employee_model.php, which is invoked when the emid parameter is submitted to that endpoint. No special or non-default configuration is required beyond a standard deployment of version 1.0 with an accessible web interface. Limiting factors include: the mandatory authenticated session (insider threat or credential compromise required), the time-intensive nature of blind SQL injection (reduces viability of fully automated mass exploitation), and the moderate impact ceiling (VC:L/VI:L/VA:L - not a full database dump or OS-level compromise in a single step).

The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) yields a base score of 5.3 (Medium), which appropriately reflects the exploitation barrier: low-privilege authentication (PR:L) is required, limiting the attack surface compared to unauthenticated flaws. The E:P modifier confirms proof-of-concept exploit code is public, elevating practical risk above a theoretical finding. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, so widespread opportunistic exploitation cannot be confirmed. The impact metrics are uniformly Low (VC:L/VI:L/VA:L), consistent with time-based blind injection that extracts data incrementally and is slow to weaponize at scale. Real-world risk is moderate for organizations running this specific product: an insider or compromised low-privilege HR account could exfiltrate the full employee database. The absence of scope change (SC:N/SI:N/SA:N) suggests the injection does not directly pivot to the underlying OS. Overall, this is a genuine medium-priority finding for affected deployments, not a theoretical-only risk given the public POC, but mass automated exploitation is constrained by the authentication prerequisite.

An attacker with a low-privilege employee account in the HR system authenticates to the application and sends a crafted HTTP request to the Update_Earn_Leave endpoint, injecting a time-based blind SQL payload (e.g., using MySQL SLEEP() or conditional CASE expressions) into the emid parameter. By observing HTTP response times, the attacker iterates character-by-character through database content, ultimately extracting employee personal data, credentials, or other sensitive HR records from the backend database. A public POC on GitHub at https://github.com/ashikmd0507/CVE/tree/main/Time-Based%20Blind%20SQL%20Injection%20in%20Update_Earn_Leave%20via%20emid%20Parameter confirms this technique is reproducible.