CVE-2026-13525: SQL Injection in CodeAstro HRIS Update_Earn_Leave Endpoint

Technical summary

CVE-2026-13525 is a SQL injection vulnerability affecting the emselectByCode function in application/models/Employee_model.php. The vulnerability exists in the Update_Earn_Leave endpoint, where the emid parameter is not properly sanitized before being used in SQL queries. An attacker with valid authentication credentials can craft specially-formed requests to inject arbitrary SQL, bypassing normal data access controls. The attack vector is network-based with low complexity, requiring only valid login credentials and no user interaction.

Business impact

This vulnerability threatens the confidentiality, integrity, and availability of HR data. Attackers could extract sensitive employee records including compensation, personal information, and leave records; modify attendance or payroll data; or delete records entirely. Organizations using CodeAstro 1.0 face regulatory compliance risks under data protection laws, potential reputational damage, and operational disruption if critical HR functions are compromised.

Affected systems

CodeAstro Human Resource Management System version 1.0 is affected. The vulnerability is triggered through the Update_Earn_Leave endpoint when processing leave balance updates. Any deployment of this version with network accessibility and active user accounts is susceptible.

Exploitability

The vulnerability is exploitable with medium effort. An attacker must possess valid authentication credentials, but the actual exploitation—crafting a SQL injection payload—requires only basic technical knowledge. The fact that public exploit code exists significantly lowers the barrier to weaponization. The low complexity vector suggests standard SQL injection payloads are likely to succeed.

Remediation

Upgrade CodeAstro to a patched version that includes input validation and parameterized queries. Until patching is possible, implement strict access controls limiting who can reach the Update_Earn_Leave endpoint, enforce strong authentication policies, and monitor database queries for anomalous patterns. Verify vendor advisories for specific patch version recommendations.

Patch guidance

Check with CodeAstro support for an available patch or updated release addressing this vulnerability. Apply any patches from the vendor immediately in a test environment before production deployment. Confirm patch applicability to your specific CodeAstro configuration. If no patch is available from the vendor, consider whether alternative HRIS solutions should be evaluated.

Detection guidance

Monitor for SQL error messages or unusual response times from the Update_Earn_Leave endpoint. Log and analyze all requests to application/models/Employee_model.php, especially those containing SQL keywords (SELECT, UNION, DROP, etc.) in the emid parameter. Implement Web Application Firewall (WAF) rules to block common SQL injection patterns. Review database access logs for queries executed by the HRIS application service account that deviate from normal patterns.

Why prioritize this

Although CVSS 6.3 (MEDIUM) reflects moderate severity, the combination of authenticated-but-easily-exploitable access, public exploit availability, and the sensitive nature of HR data justifies priority remediation. Organizations should treat this as high-priority for patching if CodeAstro is internet-facing or accessible to a large employee base.

Risk score, explained

CVSS 6.3 reflects a network-accessible vulnerability requiring authentication but with low attack complexity. The score accounts for limited scope and the requirement for valid credentials, which prevents remote unauthenticated attacks. However, the impact to confidentiality, integrity, and availability of HR data—combined with public exploit availability—elevates practical risk beyond the numerical score.

Frequently asked questions