CodeAstro Payroll System EUVD-2026-33756

Exploitation requires the attacker to hold a valid, low-privilege authenticated session on the CodeAstro Payroll System - unauthenticated access is NOT sufficient, as PR:L in the CVSS vector confirms authentication is required. The specific precondition is access to the /home_employee.php endpoint and the ability to supply a manipulated emp_id parameter, which is a standard feature of the application available to authenticated employee users. The application must be reachable over the network (AV:N), and the attack works against the default, unmodified version 1.0 with no non-standard configuration required. Exploitation is limited by the need to first obtain any valid account credential; there is no evidence of an authentication bypass chained to this issue. The unchanged scope (S:U) means impact is bounded to the application's own database context and does not directly extend to the underlying OS.

The CVSS base score of 6.3 (Medium) reflects a network-reachable (AV:N), low-complexity (AC:L) attack requiring low-privilege authentication (PR:L) with no user interaction (UI:N) and an unchanged scope. Real-world risk is moderate but meaningfully elevated by the public availability of exploit code (E:P in the temporal vector), which lowers the bar for exploitation to any attacker who can obtain a low-privilege account. The RC:R (Reasonable Confidence) modifier indicates the vulnerability is credibly reported but not yet independently confirmed at the highest assurance level. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. KEV status is absent, meaning CISA has not confirmed active in-the-wild exploitation, suggesting this is currently opportunistic rather than targeted. The low CIA impact scores (C:L/I:L/A:L) are consistent with a partially-blind SQL injection affecting a single application's database scope rather than full OS-level compromise. However, payroll data is inherently sensitive - even partial exfiltration of salary, employee, or banking records constitutes a high-severity business impact not fully captured by the CVSS score. No remediation level (RL:X) is defined, indicating no vendor patch has been issued, which sustains exposure indefinitely.

An attacker who has obtained a low-privilege account on the CodeAstro Payroll System - for example, a standard employee user - navigates to /home_employee.php and submits a crafted emp_id value containing SQL injection syntax (e.g., a UNION SELECT statement). The application passes this value unsanitized into a database query, enabling the attacker to retrieve payroll records for other employees, including salary figures, banking details, or personal identifiers. Publicly available exploit code hosted on GitHub (https://github.com/yihaofuweng/cve/issues/65) provides a ready-made template, meaning exploitation requires minimal SQL knowledge.