CodeAstro HRMS EUVD-2026-40032

Exploitation requires a valid low-privilege authenticated session within the CodeAstro Human Resource Management System application (confirmed by CVSS PR:L). The attacker must be able to reach the View Endpoint over the network (AV:N) and interact with the GetFileInfo function by supplying a manipulated ID argument. No user interaction from a victim is required (UI:N), and no special non-default configuration is needed beyond having a functional deployment of the HRMS with the employee view feature accessible. Exploitation is limited by the authentication prerequisite - unauthenticated external attackers cannot directly trigger the vulnerability without first obtaining valid credentials. The scope of impact is bounded to the HRMS application's own database (no scope change).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) scores 5.3 Medium, reflecting a genuine authentication barrier (PR:L) and limited per-impact severity (L/L/L). The E:P modifier confirms a public proof-of-concept exists, raising practical exploitability above what the base score alone implies. There is no CISA KEV listing, so active widespread exploitation is not confirmed. No EPSS score was provided in the input data. The real-world risk profile is moderate: an attacker needs a valid low-privilege account in the HRMS application, which limits opportunistic mass exploitation but leaves the system exposed to insider threats, compromised employee credentials, or brute-forced accounts. No scope change is indicated (SC:N/SI:N/SA:N), so database impact is constrained to the HRMS application's own data store. The combination of a public POC and low attack complexity once authenticated makes remediation time-sensitive for any deployment.

An attacker with a low-privilege employee account authenticates to the CodeAstro HRMS application and sends a crafted HTTP request to the View Endpoint, appending a malicious SQL payload within the ID parameter targeting the GetFileInfo function. Because the ID value is incorporated directly into a SQL query without sanitization, the injected syntax alters query logic, enabling the attacker to extract employee records, credentials, or other sensitive HR data from the database. A public proof-of-concept is available on GitHub, meaning this scenario can be reproduced with minimal SQL injection expertise.