A single input parameter in the GetFileInfo function of the Employee_model.php file is not properly validated, allowing an attacker to inject arbitrary SQL code via the ID argument. This flaw can enable manipulation of database queries, potentially granting the attacker read or write access to sensitive employee data, or facilitating further escalation. The vulnerability is a classic SQL injection as identified by CWE‑89 and the lack of input sanitation by CWE‑74. The impact is primarily the compromise of confidentiality and integrity of the database content.

The vulnerability exists in CodeAstro Human Resource Management System version 1.0. No other versions were listed; the only affected product is the HR module provided by CodeAstro. The specific file impacted is hrsystem/application/models/Employee_model.php, and it is triggered through the View Endpoint interface.

The CVSS base score of 5.3 indicates a medium severity risk. EPSS is not available, making it hard to gauge current exploitation likelihood, but the published exploit suggests the issue is actionable. The flaw can be triggered remotely without authentication, implying a non‑privileged attacker can reach it through standard web traffic. As the vulnerability is not yet listed in CISA’s KEV catalog, formal alerts are not yet issued, but its existence and availability of an exploit warrant prompt remediation.