An input parameter named emid is passed to the emselectByCode function of the Update_Earn_Leave endpoint and is concatenated directly into a SQL statement. This allows an attacker to inject arbitrary SQL code, gaining the ability to read, modify, or delete employee records stored in the database. The vulnerability is a classic instance of CWE‑74 and CWE‑89, where untrusted input reaches a database query without proper sanitization. Compromise of the HRMS database would affect confidentiality, integrity, and availability of personnel information.

The vulnerability impacts CodeAstro Human Resource Management System version 1.0. Any deployment of this product that incorporates the unsanitized emid input in the Update_Earn_Leave endpoint is susceptible, as no later releases are mentioned.

The CVSS score of 5.3 indicates medium severity, while the EPSS score is not available, leaving the exact exploitation likelihood uncertain. The public exploit code referenced in external resources demonstrates that a remote attacker possessing network access to the API can trigger the injection. Although the vulnerability is not listed in the CISA KEV catalog, the existence of a working exploit raises the risk that attacks may spread if the system remains unpatched.