| शीर्षक | CodeAstro Human Resource Management System in PHP CodeIgniter v1.0 Boolean, Error and Time-Based SQL Injection |
|---|
| विवरण | A critical SQL Injection vulnerability exists in the Human Resource Management System developed by CodeAstro. The issue is present in the employee view functionality where the (I) GET parameter is base64-decoded and passed into the GetFileInfo function without sanitization. An attacker can inject arbitrary SQL queries through this parameter, leading to full database compromise including data exfiltration, modification, and potential service disruption. The vulnerability is exploitable via boolean-based blind, error-based, and time-based SQL injection techniques. |
|---|
| स्रोत | ⚠️ https://github.com/ashikmd0507/CVE/tree/main/SQL%20Injection%20via%20GetFileInfo%20Function |
|---|
| उपयोगकर्ता | ashikmd7 (UID 98284) |
|---|
| सबमिशन | 29/05/2026 05:07 AM (4 महीनों पहले) |
|---|
| संयम | 28/06/2026 11:27 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 374543 [CodeAstro Human Resource Management System 1.0 View Endpoint Employee_model.php GetFileInfo id SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|