CVE-2026-10286: CodeAstro Payroll System home_employee.php sql injection
A vulnerability was found in CodeAstro Payroll System 1.0. This affects an unknown part of the file /homeemployee.php. The manipulation of the argument empid results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Payroll System 1.0from your environment.If the application is not required, uninstall or take the CodeAstro Payroll System instance offline until the vulnerability is remediated.
- Configuration
Modify home_employee.php so that any SQL using the emp_id parameter uses prepared statements / parameterized queries. Additionally validate or cast emp_id to an expected numeric type and reject or sanitize invalid input to prevent SQL injection.
CodeAstro Payroll System (home_employee.php) emp_id input handling = use parameterized queries; validate/cast to integer - Compensating control
Restrict remote access to the application (network ACLs or firewall allowlist) and/or place the application behind a web application firewall (WAF) configured to detect and block SQL injection attempts until code is fixed.
- Operational
Audit application and database logs for signs of exploitation of emp_id and suspicious queries. If evidence of compromise is found, follow incident response procedures (contain, investigate, rotate any impacted credentials, and restore affected components from known-good backups).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10286?
The severity of CVE-2026-10286 is medium with a score of 6.3.
What type of vulnerability is CVE-2026-10286?
CVE-2026-10286 is categorized as an SQL injection vulnerability.
How can I mitigate the risks associated with CVE-2026-10286?
To mitigate the risks of CVE-2026-10286, it's recommended to sanitize user inputs and implement prepared statements for database queries.
Can CVE-2026-10286 be exploited remotely?
Yes, CVE-2026-10286 can be exploited remotely due to its nature of manipulating the emp_id argument in the home_employee.php file.
What software is affected by CVE-2026-10286?
CVE-2026-10286 affects CodeAstro Payroll System version 1.0.