CVE-2026-12131 is a SQL injection vulnerability affecting CodeAstro Human Resource Management System 1.0. The issue exists in the Invoice function within the Payroll Invoice Module (file \application\controllers\Payroll.php). An attacker can remotely exploit this by manipulating the ID parameter, leading to unauthorized SQL command execution. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). There is no vendor-provided patch or official remediation level indicated. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the vulnerable ID parameter. This may lead to unauthorized data access, modification, or deletion within the Payroll Invoice Module. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing input validation and parameterized queries on the ID parameter in the Invoice function to mitigate SQL injection risk. Monitor for updates from CodeAstro regarding patches or official mitigations.