Payroll System
Monthly
Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in CodeAstro Payroll System 1.0 exposes database records to manipulation via the ID parameter in /view_account.php, allowing a low-privileged authenticated remote attacker to read, alter, or partially disrupt payroll data. A public proof-of-concept exploit is available via GitHub, as reported by VulDB. Despite network accessibility and public PoC, the CVSS 4.0 score of 2.1 reflects constrained impact - limited to the vulnerable component with no lateral scope - and a mandatory low-privilege authentication prerequisite that tempers broad exploitation risk.
SQL injection in CodeAstro Payroll System 1.0 exposes payroll data to manipulation by authenticated low-privilege users via unsanitized input in the salary calculation endpoint. The vulnerability affects the `rate` and `salary_rate` parameters of `/home_salary.php`, where attacker-controlled values are passed directly into SQL queries without sanitization. Publicly available exploit code exists per GitHub references, though the vulnerability is not listed in the CISA KEV catalog and carries a CVSS 4.0 base score of only 2.1, reflecting constrained real-world impact due to authentication requirements and limited CIA impact ratings.
SQL injection in CodeAstro Payroll System 1.0 allows remote authenticated attackers with low-privilege credentials to manipulate database queries via the emp_id parameter in /home_employee.php. Exploitation can result in unauthorized read access to confidential payroll records, limited data manipulation, and potential availability impact against the underlying database. Publicly available exploit code exists (referenced via GitHub), elevating real-world risk beyond the moderate CVSS score of 6.3; no public patch is available at time of analysis.
Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in CodeAstro Payroll System 1.0 exposes database records to manipulation via the ID parameter in /view_account.php, allowing a low-privileged authenticated remote attacker to read, alter, or partially disrupt payroll data. A public proof-of-concept exploit is available via GitHub, as reported by VulDB. Despite network accessibility and public PoC, the CVSS 4.0 score of 2.1 reflects constrained impact - limited to the vulnerable component with no lateral scope - and a mandatory low-privilege authentication prerequisite that tempers broad exploitation risk.
SQL injection in CodeAstro Payroll System 1.0 exposes payroll data to manipulation by authenticated low-privilege users via unsanitized input in the salary calculation endpoint. The vulnerability affects the `rate` and `salary_rate` parameters of `/home_salary.php`, where attacker-controlled values are passed directly into SQL queries without sanitization. Publicly available exploit code exists per GitHub references, though the vulnerability is not listed in the CISA KEV catalog and carries a CVSS 4.0 base score of only 2.1, reflecting constrained real-world impact due to authentication requirements and limited CIA impact ratings.
SQL injection in CodeAstro Payroll System 1.0 allows remote authenticated attackers with low-privilege credentials to manipulate database queries via the emp_id parameter in /home_employee.php. Exploitation can result in unauthorized read access to confidential payroll records, limited data manipulation, and potential availability impact against the underlying database. Publicly available exploit code exists (referenced via GitHub), elevating real-world risk beyond the moderate CVSS score of 6.3; no public patch is available at time of analysis.