Description
A security vulnerability has been detected in CodeAstro Payroll System 1.0. The impacted element is an unknown function of the file /home_salary.php. The manipulation of the argument rate/salary_rate leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-06-08
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An SQL injection flaw exists in CodeAstro Payroll System 1.0 in the /home_salary.php file, triggered by manipulating the rate/salary_rate argument. The vulnerability allows an attacker to inject arbitrary SQL statements, which can lead to unauthorized reading, modification, or deletion of payroll data. The flaw is classified as CWE‑89 and CWE‑74, indicating unsanitized input handling.

Affected Systems

The affected product is CodeAstro Payroll System, version 1.0. Any user who can access the /home_salary.php endpoint and provide a crafted rate/salary_rate value is vulnerable. No additional affected versions are listed in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, primarily limited to data confidentiality and integrity. The EPSS score is not available, but the vulnerability is publicly disclosed and can be exploited remotely, meaning that attackers with network access to the web application can attempt the injection without needing local privileges. The vulnerability is not listed in the CISA KEV catalog, but the remote attackability and public disclosure raise the potential for widespread exploitation.

Generated by OpenCVE AI on June 8, 2026 at 20:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and install the latest patch for CodeAstro Payroll System once it becomes available
  • Ensure that the rate/salary_rate parameter is validated and sanitized before use in any database query
  • Rewrite the relevant SQL statements to use prepared statements or parameterized queries so that user input cannot alter the SQL logic
  • Limit the database user permissions to the minimum necessary for application operations, restricting write privileges where possible
  • Restrict access to the /home_salary.php endpoint to authorized personnel and consider additional authentication checks

Generated by OpenCVE AI on June 8, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 08 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 08 Jun 2026 19:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in CodeAstro Payroll System 1.0. The impacted element is an unknown function of the file /home_salary.php. The manipulation of the argument rate/salary_rate leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Title CodeAstro Payroll System home_salary.php sql injection
First Time appeared Codeastro
Codeastro payroll System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:codeastro:payroll_system:*:*:*:*:*:*:*:*
Vendors & Products Codeastro
Codeastro payroll System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Codeastro Payroll System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-08T19:16:21.487Z

Reserved: 2026-06-08T05:58:14.336Z

Link: CVE-2026-11558

cve-icon Vulnrichment

Updated: 2026-06-08T19:16:18.332Z

cve-icon NVD

Status : Received

Published: 2026-06-08T19:16:41.880

Modified: 2026-06-08T19:16:41.880

Link: CVE-2026-11558

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-08T21:00:14Z

Weaknesses