This vulnerability in CodeAstro Payroll System 1.0 allows remote attackers to perform SQL injection via manipulation of the ID argument in the /view_account.php file. The injection flaw could enable attackers to interfere with the application's database queries. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated as low to medium across confidentiality, integrity, and availability, reflecting limited potential damage or complexity in exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing application-level input validation and parameterized queries as temporary mitigations to reduce risk. Monitor vendor channels for updates and apply patches promptly once available.