SQL Injection Flaws Expose SourceCodester and CodeAstro Management Apps
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 16, 2026
MITRE has published two high-severity SQL injection vulnerabilities affecting widely available PHP-based management applications: SourceCodester Payroll Management and Information System v1.0 and CodeAstro Simple Attendance Management System v1.0. The SourceCodester issue, tracked as CVE-2026-37347, affects /payroll/view_employee.php and is classified as CWE-89; its CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates remote exploitation with no privileges or user interaction required, with high impact to confidentiality and integrity.
The CodeAstro flaw, CVE-2026-37749, is also a CWE-89 SQL injection bug and affects index.php, where the username parameter can be abused by remote, unauthenticated attackers to bypass authentication. Its CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects high impact across confidentiality, integrity, and availability. Both CVE entries were updated with severity details and public references, including GitHub documentation, underscoring the exposure of internet-reachable administrative and employee-management functions to straightforward injection attacks.
