CVE-2026-13525

MEDIUM

CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection

Title source: cna

Description

A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employee_model.php of the component Update_Earn_Leave Endpoint. The manipulation of the argument emid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

References (6)

Core 6

Core References

Product product

https://codeastro.com/

Vdb Entry, Technical Description vdb-entry technical-description

VDB-374533 | CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection

https://vuldb.com/vuln/374533

Signature, Permissions Required signature permissions-required

VDB-374533 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/374533/cti

Third Party Advisory third-party-advisory

CVE-2026-13525 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-13525

Third Party Advisory third-party-advisory

Submit #840506 | CodeAstro Human Resource Management System in PHP CodeIgniter v1.0 Time-Based Blind SQL Injection

https://vuldb.com/submit/840506

Patch exploit patch

https://github.com/ashikmd0507/CVE/tree/main/Time-Based%20Blind%20SQL%20Injection%20in%20Update_Earn_Leave%20via%20emid%20Parameter

Scores

CVSS v3 6.3

EPSS 0.0020

EPSS Percentile 10.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-89

Status published

Products (1)

CodeAstro/Human Resource Management System 1.0

Published Jun 29, 2026

Tracked Since Jun 29, 2026