VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Jun 8, 2026

CVE-2026-11559

CVE-2026-11559

Description

SQL injection vulnerability in CodeAstro Payroll System 1.0 allows remote attackers to access, modify, or delete sensitive data via the ID parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SQL injection vulnerability in CodeAstro Payroll System 1.0 allows remote attackers to access, modify, or delete sensitive data via the ID parameter.

Vulnerability

A SQL injection vulnerability exists in CodeAstro Payroll System version 1.0, specifically within the /view_account.php file. The ID parameter is not properly sanitized, allowing for malicious SQL code to be injected directly into database queries. This vulnerability affects the Payroll System component [1].

Exploitation

An attacker can exploit this vulnerability remotely by manipulating the ID parameter in a request to /view_account.php. By injecting crafted SQL code, such as a time-based blind payload, an attacker can interact with the database without needing authentication or special privileges. The exploit is publicly available [1].

Impact

Successful exploitation of this SQL injection vulnerability allows attackers to gain unauthorized access to the database. This can lead to sensitive data leakage, data tampering, or even complete system control. In severe cases, it could also result in service interruption [1].

Mitigation

No specific patched version or release date has been disclosed in the available references. Users are advised to consult the vendor for potential updates or patches. The vendor's website is available at https://codeastro.com/ [2].

References
  1. codeastro Payroll System V1.0 /PayrollSy-PHP/view_account.php?emp_id=13 SQL injection
  2. CodeAstro

AI Insight generated on Jun 8, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Insufficient cleaning or validation of the 'id' parameter allows for SQL injection."

Attack vector

An attacker can manipulate the 'ID' argument in the `/view_account.php` file to inject malicious SQL code. This is possible because the application directly uses the input in SQL queries without proper sanitization. The attack can be performed remotely, and the exploit is publicly available [ref_id=1].

Affected code

The vulnerability exists in the `/view_account.php` file, specifically concerning the manipulation of the 'id' parameter. The root cause is the direct use of this parameter in SQL queries without adequate cleaning or validation, as detailed in the reference write-up [ref_id=1].

What the fix does

The advisory suggests using prepared statements and parameter binding to prevent SQL injection, as this treats user input as data rather than executable SQL code. Additionally, it recommends strict input validation and filtering to ensure data conforms to expected formats. Minimizing database user permissions and conducting regular security audits are also advised remediation steps [ref_id=1].

Preconditions

  • authThe attacker has low privileges (PR:L).
  • networkThe vulnerability is accessible over the network (AV:N).

Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.