CVE-2026-13535: CodeAstro HRMS SQLi Vulnerability

CVE-2026-13535 Overview

CVE-2026-13535 is a SQL injection vulnerability in CodeAstro Human Resource Management System 1.0. The flaw resides in the GetFileInfo function within hrsystem/application/models/Employee_model.php, part of the View Endpoint component. An authenticated attacker can manipulate the ID argument to inject arbitrary SQL statements against the backend database. The attack is remotely exploitable over the network and requires low privileges. A public proof-of-concept exploit has been published, increasing the practical risk to deployed instances. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote authenticated attackers can inject SQL through the ID parameter in GetFileInfo, potentially exposing or altering employee records in the HRMS database.

Affected Products

CodeAstro Human Resource Management System 1.0
Component: View Endpoint (hrsystem/application/models/Employee_model.php)
Vulnerable function: GetFileInfo

Discovery Timeline

2026-06-29 - CVE-2026-13535 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13535

Vulnerability Analysis

The vulnerability is a classic SQL injection reachable through the GetFileInfo function of the Employee_model.php file in CodeAstro Human Resource Management System 1.0. The function accepts an ID argument sourced from a user-controlled request parameter and passes it into a SQL query without proper sanitization or parameterization. Because the query is constructed via string concatenation, attackers can break out of the intended query context and append their own SQL clauses.

Exploitation succeeds over the network and requires only low privileges, meaning a standard authenticated user of the HRMS can trigger the flaw. No user interaction is required. The public proof-of-concept increases the likelihood of opportunistic exploitation against exposed instances.

Root Cause

The root cause is improper neutralization of special characters in a downstream SQL component [CWE-74]. The GetFileInfo handler treats the ID parameter as trusted input and concatenates it directly into a query string. The application does not use prepared statements, parameter binding, or input validation to enforce that ID is a well-formed integer.

Attack Vector

An attacker with a valid low-privilege session sends a crafted HTTP request to the View Endpoint that reaches GetFileInfo. The ID parameter is populated with SQL metacharacters and payloads such as UNION SELECT clauses or boolean-based conditionals. The backend database executes the injected SQL in the application's security context, allowing data extraction, record enumeration, or tampering with HR records.

A public proof-of-concept for this attack path is available on GitHub. No verified exploit code is reproduced here; see the linked repository and the VulDB entry for CVE-2026-13535 for technical details.

Detection Methods for CVE-2026-13535

Indicators of Compromise

HTTP requests targeting the View Endpoint with SQL metacharacters (', --, UNION, SELECT, SLEEP) in the ID parameter.
Anomalous or repeated queries to Employee_model.php handlers from a single authenticated session.
Database error messages or unusually large response bodies returned from endpoints that normally return a single employee record.

Detection Strategies

Enable verbose web server and application logging for the hrsystem application and alert on non-numeric values in the ID parameter.
Deploy a web application firewall (WAF) with SQL injection signatures tuned for CodeInigniter-style query patterns.
Review database query logs for UNION, INFORMATION_SCHEMA, or time-based sleep functions originating from the HRMS service account.

Monitoring Recommendations

Alert on authenticated sessions issuing unusually high request volumes to employee data endpoints.
Monitor for outbound data transfers from the HRMS database host that deviate from baseline volumes.
Correlate authentication logs with request logs to identify accounts probing multiple ID values in short succession.

How to Mitigate CVE-2026-13535

Immediate Actions Required

Restrict network access to the CodeAstro HRMS application to trusted internal networks or VPN users only.
Audit and disable non-essential low-privilege accounts that can reach the View Endpoint.
Deploy WAF rules that block SQL metacharacters in the ID parameter of the View Endpoint.

Patch Information

No vendor patch has been referenced in the NVD entry for CVE-2026-13535 at the time of publication. Administrators should monitor the CodeAstro website for security updates and consult the VulDB advisory for further guidance. Until a vendor fix is available, apply the workarounds below.

Workarounds

Modify GetFileInfo in hrsystem/application/models/Employee_model.php to use parameterized queries or CodeIgniter query bindings instead of string concatenation.
Enforce strict server-side input validation to accept only integer values for the ID parameter, rejecting all other input.
Run the HRMS database account with the minimum privileges required, removing DROP, ALTER, and cross-database SELECT permissions.
Place the HRMS behind a reverse proxy with SQL injection filtering until the vulnerable code path is remediated.

bash

# Example CodeIgniter query binding to remediate the vulnerable pattern
# Replace concatenation such as: $this->db->query("SELECT * FROM employee WHERE id = ".$id);
# With parameter binding:
$sql = "SELECT * FROM employee WHERE id = ?";
$query = $this->db->query($sql, array((int)$id));