This vulnerability in CodeAstro Payroll System 1.0 involves SQL injection via the ID parameter in /view_account.php. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known, but no official fix or mitigation has been published by the vendor as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability requires no user interaction and can be exploited remotely, increasing risk. However, the CVSS score and vector indicate limited impact scope and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply input validation and parameterized queries on the affected parameter as a temporary mitigation. Monitor for updates from CodeAstro regarding an official patch.