CodeAstro Human Resource Management System vulnerabilities

A cross-site request forgery (CSRF) vulnerability was found in CodeAstro Human Resource Management System 1.0. An unknown function allows remote attackers to perform unauthorized actions on behalf of an authenticated user. The exploit has been made public and could be used.

A SQL injection vulnerability was found in CodeAstro Human Resource Management System 1.0 in the GetFileInfo function of Employee_model.php. Manipulating the ID argument in the view endpoint allows remote attack. The exploit has been published and may be used.

A SQL injection vulnerability was found in CodeAstro Human Resource Management System 1.0 in the emselectByCode function of Employee_model.php. The attack manipulates the emid argument in the Update_Earn_Leave endpoint. It can be exploited remotely and the exploit is publicly available.

A stored XSS vulnerability was found in CodeAstro Human Resource Management System 1.0 in the Notice Board Management function. Manipulating the 'Notice Title' argument via POST with JavaScript code leads to script execution in the victim's browser.