CVE-2026-13525 Details

A time-based blind SQL injection vulnerability has been identified in CodeAstro Human Resource Management System version 1.0. The issue arises in the Update_Earn_Leave endpoint, specifically within the Employee_model.php file, in the emselectByCode function. The vulnerability allows authenticated users to inject arbitrary SQL commands through the emid POST parameter, which is then executed by the application's MySQL database. This exploitation could lead to unauthorized data access, manipulation, or in severe cases, a complete database compromise.

To address this vulnerability, use parameterized queries or prepared statements to prevent user input from being directly concatenated into SQL queries. Implement strict input validation, ensure database accounts operate under the principle of least privilege, enable centralized logging and monitoring, and consider deploying a Web Application Firewall (WAF) to mitigate exploitation risks.