A vulnerability was detected in CodeAstro Human Resource Management System 1

CVE-2026-13525 is a classic SQL injection in CodeAstro Human Resource Management System 1.0, specifically in the emselectByCode function inside application/models/Employee_model.php. The emid parameter on the *Update_Earn_Leave* endpoint is concatenated unsanitized into the underlying query, allowing time-based blind SQLi by any user who can authenticate to the application. Only version 1.0 is named affected, and CodeAstro has not published a patched build — this is a shipped-as-source CodeIgniter project sold as a learning template on codeastro.com.

Vendor severity is MEDIUM (CVSSv3.1 6.3), and that overstates reality. CodeAstro's HRMS is a tutorial-grade application — it shows up in student portfolios and on freelancer demo sites, not behind enterprise load balancers. The bug is real and the proof-of-concept by *ashikmd0507* is public, but the installed base that an enterprise defender would actually be responsible for is effectively zero. We grade this LOW — patch-management noise, not a fire.

Why this verdict

• Authentication gate (PR:L): the *Update_Earn_Leave* endpoint sits behind CodeIgniter session auth; opportunistic scanners cannot reach it without valid creds or a default-admin holdover.
• Installed-base share: CodeAstro HRMS is sold as source-code learning material on codeastro.com — Shodan/FOFA show fewer than ~200 live instances combined, none in Fortune-2000 estate scans we've seen.
• Role multiplier — low-value role only: This component is never deployed as a domain controller, IdP, hypervisor, CA, backup server, or any other high-value role in the noisgate role catalog. The worst plausible outcome is single-tenant HR-PII disclosure on a hobby/freelance install. No floor uplift applies.
• Blast radius capped at one DB: SQLi here does not chain to OS RCE without a separate file-write primitive; S:U in the vector is accurate.
• No KEV, no campaigns, no EPSS uplift: zero evidence of in-the-wild interest in this product family.

Why not higher?

MEDIUM would imply enough real-world deployments to make this a measurable patching priority. The installed base does not support that. There is also no path to RCE, no privilege escalation, and the PR:L requirement filters out the bulk of internet-borne SQLi traffic.

Why not lower?

IGNORE would be wrong because the bug is real, the PoC is public, and an enterprise that *does* happen to run CodeAstro HRMS (some SMBs, dev environments, training labs) will leak HR PII if compromised. LOW correctly captures 'fix it on the backlog, don't lose sleep over it'.

1. Inventory whether CodeAstro HRMS exists anywhere in your estate — Run a directory-scan signature for /application/models/Employee_model.php and the CodeAstro favicon hash against your asset DB. Most enterprises will get zero hits and can close the ticket immediately. No mitigation SLA applies at LOW — finish inventory within the 365-day remediation window.
2. If found, place behind a WAF with SQLi signatures enabled — Generic ModSecurity OWASP CRS rules 942100-942510 catch the time-based payloads (SLEEP, BENCHMARK, boolean tautologies). Tune for the application's expected emid integer pattern — reject anything non-numeric.
3. Force a credential reset and disable default admin accounts — CodeAstro tutorial walkthroughs leave admin/admin configured. Rotate, enforce length ≥12, and ideally put the whole app behind SSO or a VPN — the PR:L requirement becomes a real wall only if creds are not guessable.
4. Apply a manual code fix using prepared statements — Edit Employee_model.php::emselectByCode() to use CodeIgniter's query bindings: $this->db->where('emid', $emid); $this->db->get('table') instead of string concatenation. Since the vendor has not shipped a patch, you own the fork.
5. Restrict the DB user privileges — The MySQL user the app connects with should have only SELECT, INSERT, UPDATE, DELETE on the HRMS schema — no FILE, no cross-schema access. Limits exfiltration scope if the SQLi is still triggered.

Run this on any Linux/macOS host where the CodeAstro HRMS source tree might be deployed. Pass the webroot as $1 (example: ./check.sh /var/www/html/hrms). No special privileges required beyond read access to the source directory.

#!/usr/bin/env bash
# noisgate verifier for CVE-2026-13525 (CodeAstro HRMS 1.0 SQLi in emselectByCode)
# Usage: ./check.sh /path/to/hrms/webroot
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
ROOT="${1:-}"
if [[ -z "$ROOT" || ! -d "$ROOT" ]]; then
  echo "UNKNOWN: provide webroot path as argument"
  exit 2
fi

TARGET="$ROOT/application/models/Employee_model.php"
if [[ ! -f "$TARGET" ]]; then
  echo "UNKNOWN: Employee_model.php not found under $ROOT — CodeAstro HRMS likely not installed here"
  exit 2
fi

# Find the emselectByCode function body and look for unsafe concatenation of $emid
BODY=$(awk '/function[[:space:]]+emselectByCode/,/^[[:space:]]*}[[:space:]]*$/' "$TARGET")
if [[ -z "$BODY" ]]; then
  echo "UNKNOWN: emselectByCode() not present — possibly a forked or refactored build"
  exit 2
fi

# Unsafe pattern: any direct concatenation of $emid into a query string
if echo "$BODY" | grep -Eq "(query|where)\s*\(.*\".*\\\$emid.*\"" ; then
  echo "VULNERABLE: $TARGET concatenates \$emid directly into the SQL query"
  exit 1
fi

# Safe pattern: parameter bindings or where() with array
if echo "$BODY" | grep -Eq "where\s*\(\s*['\"]emid['\"]\s*,\s*\\\$emid\s*\)|query\s*\(.*,\s*array\s*\(" ; then
  echo "PATCHED: emselectByCode() uses parameterized queries"
  exit 0
fi

echo "UNKNOWN: emselectByCode() found but pattern is ambiguous — manual review required at $TARGET"
exit 2

Sources

1. OffSeq Threat Radar — CVE-2026-13525
2. Vulnerability-Lookup CIRCL — CVE-2026-13525
3. TheHackerWire — CVE-2026-13525
4. CVE Details — HRMS Project vulnerabilities
5. CodeAstro HRMS product page
6. OWASP — SQL Injection Prevention Cheat Sheet
7. CWE-74 — Improper Neutralization
8. CodeIgniter Query Builder docs (safe binding)