CVE-2026-11558: CodeAstro Payroll System home_salary.php sql injection
A security vulnerability has been detected in CodeAstro Payroll System 1.0. The impacted element is an unknown function of the file /homesalary.php. The manipulation of the argument rate/salaryrate leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Payroll System /home_salary.phpfrom your environment.Temporarily disable or remove the /home_salary.php endpoint or the payroll feature that uses it until a secure code fix is implemented.
- Compensating control
Block external access to the vulnerable endpoint and/or deploy a web application firewall (WAF) rule to detect and block SQL injection attempts targeting the 'rate' / 'salary_rate' parameter. Restrict access to the application to trusted IP ranges where possible.
- Operational
Fix the application code handling the 'rate' / 'salary_rate' parameter in /home_salary.php: validate and sanitize input (ensure expected numeric format) and use parameterized queries / prepared statements rather than concatenating user input into SQL.
- Operational
Assume potential compromise due to public disclosure: review access and application logs for suspicious activity, and rotate any credentials, API keys, or database credentials that may have been exposed or used by the application.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11558?
CVE-2026-11558 has a severity rating of low with a score of 2.1.
How do I fix CVE-2026-11558?
To fix CVE-2026-11558, validate and sanitize input parameters in the /home_salary.php file to prevent SQL injection attacks.
What type of vulnerability is CVE-2026-11558?
CVE-2026-11558 is classified as an SQL Injection vulnerability.
Is CVE-2026-11558 exploitable remotely?
Yes, CVE-2026-11558 can be exploited remotely.
Which component of CodeAstro Payroll System is affected by CVE-2026-11558?
The affected component in CodeAstro Payroll System is the /home_salary.php file.