CVE-2026-12131: CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection
A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\controllers\Payroll.php of the component Payroll Invoice Module. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Human Resource Management System Payroll Invoice Modulefrom your environment.If Invoice functionality is not required, uninstall or remove the Payroll Invoice Module from the application to eliminate the vulnerable code path.
- Configuration
Disable the Invoice function in application configuration or block access to the endpoint (URL) invoking application/controllers/Payroll.php::Invoice until a vendor fix is available.
CodeAstro Human Resource Management System - Payroll Invoice Module Invoice function (application/controllers/Payroll.php::Invoice) = disabled - Compensating control
Restrict access to the endpoint that accepts the ID parameter (use firewall, web server access controls, or network ACLs to allow only trusted IPs). Deploy or tune a Web Application Firewall (WAF) to detect and block SQL injection attempts against the ID parameter.
- Operational
Search application and web server logs for signs of exploitation of the Invoice/ID parameter, investigate for unauthorized access or data exfiltration, and rotate credentials/secrets if compromise is suspected. Apply vendor-provided patches as soon as they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12131?
CVE-2026-12131 has a medium severity level of 6.3.
What kind of vulnerability is CVE-2026-12131?
CVE-2026-12131 is classified as a SQL Injection vulnerability affecting the CodeAstro Human Resource Management System.
How do I fix CVE-2026-12131?
To fix CVE-2026-12131, sanitize and validate user inputs in the Invoice function of Payroll.php to prevent SQL Injection.
Which software is affected by CVE-2026-12131?
CVE-2026-12131 affects CodeAstro Human Resource Management System version 1.0.
Can CVE-2026-12131 be exploited remotely?
Yes, CVE-2026-12131 can be exploited remotely due to its nature as a SQL Injection vulnerability.