Ashikmd7

**Name of the Vulnerable Software and Affected Versions** CodeAstro Complaint Management System version 1.0 **Description** An issue in the Report Handler component allows remote exploitation via cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The flaw exists in the processing of the '/report/addreport' endpoint when manipulating the `Report Title` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the `Report Title` argument in the '/report/addreport' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Human Resource Management System version 1.0 **Description** An issue exists in the Update Earn Leave endpoint where the `emselectByCode()` function within the `application/models/Employee model.php` file does not properly handle the `emid` argument. This allows a remote attacker to perform SQL injection, a technique used to execute malicious SQL statements that can manipulate a database. **Recommendations** Update CodeAstro Human Resource Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the Update Earn Leave endpoint or avoid using the `emid` argument until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Human Resource Management System version 1.0 **Description** An issue exists in the View Endpoint component where the `GetFileInfo()` function within the file `hrsystem/application/models/Employee model.php` is susceptible to SQL injection. This occurs when the `ID` argument is manipulated, allowing a remote attacker to execute unauthorized SQL commands. **Recommendations** Update CodeAstro Human Resource Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `GetFileInfo()` function or sanitize the `ID` argument to prevent SQL injection.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Human Resource Management System version 1.0 **Description** An issue exists that allows for cross-site request forgery (CSRF), a type of attack that forces an authenticated user to execute unwanted actions on a web application. This flaw can be exploited remotely through an unknown function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Complaint Management System version 1.0 **Description** An authorization bypass exists in the Report Endpoint component within the `deletereport()` function of the `application/controllers/Report.php` file. This flaw allows a remote attacker to bypass authorization requirements and execute unauthorized actions. **Recommendations** As a temporary workaround, restrict access to the `deletereport()` function in the `application/controllers/Report.php` file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Human Resource Management System version 1.0 **Description** Cross site scripting can be triggered remotely via the manipulation of the `todo data` argument within the '/dashboard/add tod' endpoint of the Dashboard Interface component. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Human Resource Management System version 1.0 **Description** A security flaw in the Projects Management Page component allows for remote cross-site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites. The issue exists within the '/Projects/Add Projects' endpoint and is triggered by the manipulation of the `protitle` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Human Resource Management System version 1.0 **Description** An SQL injection issue exists within the Payroll Invoice Module. The flaw is located in the `Invoice()` function of the `applicationcontrollersPayroll.php` file, where improper handling of the `ID` argument allows for remote exploitation. **Recommendations** Update CodeAstro Human Resource Management System to a version that resolves this issue. As a temporary workaround, restrict access to the `Invoice()` function within the `applicationcontrollersPayroll.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Human Resource Management System version 1.0 **Description** A stored cross-site scripting issue exists in the Notice Board Management component within the file '/notice/All notice'. A remote attacker can execute this by manipulating the `Notice Title` argument via a POST request. Cross-site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.