PT-2026-53195 · Codeastro · Codeastro Human Resource Management System

Ashikmd7 · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-13525

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CodeAstro Human Resource Management System version 1.0

Description An issue exists in the Update Earn Leave endpoint where the emselectByCode() function within the application/models/Employee model.php file does not properly handle the emid argument. This allows a remote attacker to perform SQL injection, a technique used to execute malicious SQL statements that can manipulate a database.

Recommendations Update CodeAstro Human Resource Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the Update Earn Leave endpoint or avoid using the emid argument until a fix is applied.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-13525

Affected Products

Codeastro Human Resource Management System

References · 8

• 🔥 https://github.com/ashikmd0507/CVE/tree/main/Time-Based%20Blind%20SQL%20Injection%20in%20Update_Earn_Leave%20via%20emid%20Parameter · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-13525 · Security Note
• https://twitter.com/VulmonFeeds/status/2071454058821382503 · Twitter Post
• https://vuldb.com/cve/CVE-2026-13525 · Note
• https://vuldb.com/vuln/374533 · Note
• https://vuldb.com/vuln/374533/cti · Note
• https://vuldb.com/submit/840506 · Note
• https://codeastro.com · Note