CVE-2026-12131 is a SQL injection vulnerability affecting CodeAstro Human Resource Management System version 1.0. The flaw exists in the Invoice function within the Payroll Invoice Module, specifically in the \application\controllers\Payroll.php file, where manipulation of the ID argument can lead to injection of malicious SQL commands. This vulnerability can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or patch has been disclosed, and the exploit code is publicly available.

Successful exploitation of this vulnerability allows remote attackers with low privileges to perform SQL injection attacks via the ID parameter in the Payroll Invoice Module. This can lead to unauthorized access or modification of database contents, potentially compromising sensitive payroll and HR data. The vulnerability does not require user interaction but has low confidentiality, integrity, and availability impact metrics according to CVSS 4.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply input validation and parameterized queries on the ID parameter in the Payroll Invoice Module to mitigate SQL injection risks.