This vulnerability involves SQL injection in CodeAstro Payroll System 1.0, specifically in an unknown function of the /home_salary.php file. Manipulating the rate or salary_rate parameter allows an attacker to inject SQL commands remotely. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed but lacks an official fix or vendor advisory at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. However, the impact is rated medium severity, reflecting limited scope or complexity of exploitation. There are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and monitor for suspicious activity related to the rate or salary_rate parameters. Avoid exposing the vulnerable service directly to untrusted networks if possible.