The flaw appears in the view_account.php file of CodeAstro Payroll System 1.0. An attacker can supply a crafted ID parameter that is not properly sanitized, allowing the execution of arbitrary SQL statements against the underlying database. This vulnerability is a classic SQL injection, which can compromise confidentiality by revealing employee payroll records and could, in certain configurations, allow modification or deletion of data.

This issue is limited to CodeAstro Payroll System 1.0. Only installations of that version running the affected view_account.php endpoint are at risk. The vendor is CodeAstro; the product is Payroll System. No other versions or products are listed as impacted.

The CVSS base score of 5.3 indicates a medium severity; the exploitable vector is remote because the attack can be performed over the web. The EPSS is not available and the vulnerability is not yet listed in the CISA KEV catalog, implying that widespread exploitation may not yet be documented. Nevertheless, the public nature of the exploit means that attackers can repeatedly target the vulnerable endpoint if the flaw remains unpatched. The flaw is prone to injection due to improper handling of the ID parameter, as highlighted by CWE-74 and CWE-89.